GHSA-6mq3-xmgp-pjm5 CVE-2026-27840 GO-2026-4573
ZITADEL's truncated opaque tokens are still valid
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.16%
- Chance of exploitation in the next 30 days. Higher than 5.03% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-302 Authentication Bypass by Assumed-Immutable Data
- Fix
4.11.0- Upgrade github.com/zitadel/zitadel to this version or later
Description
Summary
Opaque OIDC access tokens in v2 format, truncated to 80 characters are still considered valid.
ZITADEL uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different versions of token payloads. v1 tokens are no longer created, but are still verified as to not invalidate existing session after upgrade.
The cleartext payload has a format of <token_id>:<user_id>. v2 tokens distinguished further where the token_id is of the format v2_<oidc_session_id>-at_<access_token_id>. This is an example of such a cleartext: V2_354201447279099906-at_354201447279165442:354201364702363650
Impact
V1 token authZ/N session data is retrieved from the database using the (simple) token_id value and user_id value. The user_id (called subject in some parts of our code) was used as being the trusted user ID.
V2 token authZ/N session data is retrieved from the database using the oidc_session_id and access_token_id and in this case the user_id from the token is ignored and taken from the session data in the database.
By truncating the token to 80 chars, the user_id is now missing from the cleartext of the v2 token: V2_354201447279099906-at_354201447279165442: The back-end still accepts this for above reasons.
This issue is not considered exploitable, but may look awkward when reproduced.
Affected Versions
All versions within the following ranges, including release candidates (RCs), are affected:
- v4.x:
4.0.0through4.10.1 - 3.x:
3.0.0through3.4.6 - 2.x:
2.31.0through2.71.19
Patches
The vulnerability has been addressed in the latest releases. The patch resolves the issue by verifying the user_id from the token against the session data from the database
4.x: Upgrade to >=4.11.0 3.x: Update to >=3.4.7 2.x: Update to >=3.4.7
Workarounds
The recommended solution is to update ZITADEL to a patched version.
Questions
If there any questions or comments about this advisory, please send an email to security@zitadel.com
Credits
ZITADEL thanks Olivier Becker and Lucas Dodgson for reporting this vulnerability.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/zitadel/zitadel | >= 4.0.0, < 4.11.0 |
4.11.0 |
| github.com/zitadel/zitadel | >= 3.0.0, < 3.4.7 |
3.4.7 |
| github.com/zitadel/zitadel | >= 2.31.0, <= 2.71.19 |
No fix yet |
| github.com/zitadel/zitadel | < 1.80.0-v2.20.0.20260216092519-feab8e1fa371 |
1.80.0-v2.20.0.20260216092519-feab8e1fa371 |
| github.com/zitadel/zitadel | all versions |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/zitadel/zitadel Go → 4.11.0
- go
go get github.com/zitadel/zitadel@v4.11.0 && go mod tidy
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-302: Authentication Bypass by Assumed-Immutable Data
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
How to prevent it
- Architecture and Design, Operation, Implementation: Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fgmf-7rf8-m6vf ZITADEL: Actions V1 sandbox escape: host file read via require() | High | Also affects github.com/zitadel/zitadel |
| GHSA-9993-rfwp-rhwf ZITADEL: MFA bypass via session reuse in Login V2 | High | Also affects github.com/zitadel/zitadel |
| GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions | Medium | Also affects github.com/zitadel/zitadel |
| GHSA-jq8w-8q2f-ffm9 ZITADEL Users Can Self-Verify Email/Phone via API | High | Also affects github.com/zitadel/zitadel |
| GHSA-vrh8-c9cm-wh8v ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange | High | Also affects github.com/zitadel/zitadel |
| GHSA-992q-9gwp-7r79 ZITADEL: Auto-linking by email: IdP-side email verification is not checked | Medium | Also affects github.com/zitadel/zitadel |
| GHSA-v77h-2w3m-94hx ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider | Medium | Also affects github.com/zitadel/zitadel |
| GHSA-g5h5-m4hm-xjrr ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider | Medium | Also affects github.com/zitadel/zitadel |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor