| id: GO-2026-5732 |
| modules: |
| - module: github.com/zitadel/zitadel |
| versions: |
| - fixed: 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 |
| vulnerable_at: 1.80.0-v2.20 |
| summary: 'ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider in github.com/zitadel/zitadel' |
| ghsas: |
| - GHSA-wxg7-w2v3-w38g |
| references: |
| - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g |
| - fix: https://github.com/zitadel/zitadel/commit/fad02c6d9f4587956f830d4536c64a9a94baa7ac |
| - web: https://github.com/zitadel/zitadel/releases/tag/v3.4.12 |
| - web: https://github.com/zitadel/zitadel/releases/tag/v4.15.2 |
| source: |
| id: GHSA-wxg7-w2v3-w38g |
| created: 2026-06-25T15:32:56.189991554-04:00 |
| review_status: UNREVIEWED |
