CVE-2026-55669: ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

An authentication bypass vulnerability was discovered in ZITADEL’s external JWT Identity Provider (IdP) implementation.

When validating JSON Web Tokens (JWTs) from an external provider, ZITADEL properly checks the token’s cryptographic signature and issuer (iss), but it fails to validate the audience (aud) claim.

As a result, any validly signed token from the trusted issuer will be accepted. An attacker who is a legitimate user of a completely separate service sharing the same enterprise Identity Provider can intercept or present their token for that service to ZITADEL, successfully authenticating as that user without authorization.