Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 ZITADEL, OAuth2 Token Exchange Privilege Escalation, #CVE-2026-56668 (High) -DC-Sep2026-2378 https://dailycve.com/zitadel-oauth2-token-exchange-privilege-escalation-cve-2026-56668-high-dc-sep2026-2378/
Post summary
The tweet discloses CVE-2026-56668 affecting ZITADEL, describing it as an OAuth2 token exchange privilege escalation vulnerability and provides a link to a DailyCVE article for further information.