ZITADEL OAuth2 Token Exchange Vulnerability Enables Privilege Escalation

According to the GitHub Security Advisory database, ZITADEL versions 3.0.0 through 3.4.12 and 4.0.0 through 4.15.2 contain a high-severity vulnerability in the OAuth2 Token Exchange endpoint. This flaw allows authenticated users or clients to exchange low-privilege access tokens for tokens with elevated permissions in entirely different applications, bypassing configured authorization and separation policies. The issue arises from missing audience ownership verification and scope restrictions during token exchange, enabling attackers to gain unauthorized access to sensitive roles or data.

Operators should carefully review their use of public clients, as these do not require client secrets and could amplify the risk of exploitation. Before upgrading to patched versions 4.15.3 or later, ensure that no critical workflows rely on the previous token exchange behavior, as the patch enforces stricter validation rules that could affect existing integrations. This vulnerability highlights the importance of auditing token exchange mechanisms for proper scope and audience validation, a recurring concern across OAuth2 implementations.