ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

CVE-2026-53431: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover

Authentication Bypass by Spoofing vulnerability in ueberauth ueberauthapple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback idtoken against Apple's JWKS but does not validate any registered...

JWT Expiration Bypass

ZITADEL is vulnerable to JWT expiration bypass. The vulnerability is due to the external JWT Identity Provider validation skipping expiration handling when an incoming token omits the exp claim, where a token from a trusted issuer can be treated as valid without an automatic expiration window, an...

CVE-2026-56665

ZITADEL's external JWT Identity Provider validation (internal/idp/providers/jwt/session.go) does not enforce expiration when an incoming token omits the exp claim, causing tokens from trusted issuers to be treated as valid without an automatic expiration window. Affected releases: 3.0.0-rc.1 thro...

PT-2026-57253

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0-rc.1 through 3.4.11 ZITADEL versions 4.0.0-rc.1 through 4.15.1 Description External JWT Identity Provider validation in the internal/idp/providers/jwt/session.go file skips expiration handling when an incoming token omit...

CVE-2026-56665: Insufficient Session Expiration

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session....

CVE-2026-46455: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks... with only the subject-exists check and the realm-URL issuer check. Keycloak's...

NPM: Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

NPM: Hono has improper validation of NumericDate claims exp, nbf, iat in JWT verify vulnerability discovered by ? in WordPress Npm hono versions 4.12.18...

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Summary Improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches...