THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-v77h-2w3m-94hx (medium) — ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

[GHSA] GHSA-v77h-2w3m-94hx (medium) — ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

medgithub_advisoriesPublished 2026-09-11

GHSA-v77h-2w3m-94hx Severity: medium CVE: CVE-2026-56665

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

### Summary

A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation Specifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently sk

Indicators of compromise

Original source: https://github.com/advisories/GHSA-v77h-2w3m-94hx