JWT Audience Claim Validation Bypass in ZITADEL

Executive Summary

This vulnerability exists in ZITADEL's external JWT Identity Provider implementation where it validates a token's signature and issuer but does not validate the audience (aud) claim.

Because the audience claim is not checked, a validly signed token from a trusted issuer intended for another relying party can be accepted by ZITADEL, allowing an attacker to authenticate as another user.

The vulnerability affects versions 4.0.0 to 4.15.1 and 3.0.0 to 3.4.11 and is fixed in versions 4.15.2 and 3.4.12.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authentication bypass due to missing audience claim validation in JWT tokens, which could lead to unauthorized access to user identities managed by ZITADEL.

Such unauthorized access risks compromising personal data and identity information, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information.

Mitigating this vulnerability by upgrading to fixed versions or configuring unique audience values helps maintain compliance by ensuring proper authentication and authorization mechanisms.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who possesses a valid token from a shared Identity Provider (IdP) but intended for a different relying party to bypass authentication in ZITADEL.

As a result, the attacker could gain unauthorized access to resources or services protected by ZITADEL by impersonating another user.

The impact includes potential unauthorized access and identity impersonation, which could lead to data exposure or misuse of services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the acceptance of JWT tokens without proper audience (aud) claim validation in ZITADEL's external JWT Identity Provider. Detection would involve inspecting JWT tokens accepted by ZITADEL to verify if the audience claim is properly validated.

Since the vulnerability allows tokens valid for other relying parties to be accepted, monitoring authentication logs for tokens with unexpected or mismatched audience claims could help detect exploitation attempts.

No specific detection commands or tools are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade ZITADEL to version 3.4.12 or 4.15.2 or later, where the audience claim validation issue is fixed.

As a workaround, configuring unique audience values at the Identity Provider (IdP) or at perimeter layers can help prevent tokens issued for other relying parties from being accepted.

Useful 0 Not Useful 0