[GHSA] GHSA-vrh8-c9cm-wh8v (high) — ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

GHSA-vrh8-c9cm-wh8v Severity: high CVE: CVE-2026-56668

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

### Summary

A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorizatio