ZITADEL fixes missing `exp` validation in JWT IdP provider

The ZITADEL project has addressed a security vulnerability affecting its external JWT Identity Provider (IdP) implementation in versions 3.x and 4.x. According to the GitHub Security Advisory database, the issue arises when incoming JWTs omit the `exp` claim. Instead of rejecting such tokens, ZITADEL's validation pipeline silently skips expiration checks, effectively treating the token as valid indefinitely. This behavior violates the OIDC Core 1.0 specification, which mandates strict enforcement of session expiration to maintain session integrity.

The vulnerability impacts systems running versions 3.0.0 through 3.4.11 and 4.0.0 through 4.15.1, including release candidates. The issue has been resolved in versions 3.4.12 and 4.15.2, where ZITADEL now explicitly rejects tokens missing the `exp` claim. Operators unable to upgrade immediately are advised to ensure their upstream IdP enforces inclusion of the `exp` claim in all signed JWTs.

Before upgrading, operators should verify whether their external IdP configurations rely on tokens without an `exp` claim. If such tokens are in use, the upgrade may disrupt authentication flows, as these tokens will now be rejected. This change aligns with broader trends in identity management systems, where stricter adherence to token lifecycle validation is becoming a standard practice for enhanced security.