CVE Explorer

CVE-2026-27840

ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2 format truncated to 80 characters are still considered valid. Zitadel uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different versions of token payloads. v1 tokens are no longer created, but are still verified

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:85b760a4377bd54ddfa32d2b76a209e7c1ae8e483d3a59252b9752e75bf2edd5

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"zitadel","vendor":"zitadel","versions":[{"status":"affected","version":">= 4.0.0, < 4.11.0"},{"status":"affected","version":">= 3.0.0, < 3.4.7"},{"status":"affected","version":">= 2.31.0, <= 2.71.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-302","description":"CWE-302: Authentication Bypass by Assumed-Immutable Data","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/zitadel/zitadel/releases/tag/v3.4.7","tags":["x_refsource_MISC"],"url":"https://github.com/zitadel/zitadel/releases/tag/v3.4.7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/references/1

{"name":"https://github.com/zitadel/zitadel/releases/tag/v4.11.0","tags":["x_refsource_MISC"],"url":"https://github.com/zitadel/zitadel/releases/tag/v4.11.0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/references/2

{"name":"https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9b24d4cf41ac8100357a294b1cf93ed86aec0e6c05e4339d90ee9cb8e5400da9 · sha256:a75aff2835084e5f… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer