GHSA-wxg7-w2v3-w38g: ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

Two closely related token lifecycle validation vulnerabilities were discovered in ZITADEL’s external JWT Identity Provider (IdP) implementation.

Specifically, within the validation pipeline:

• Missing Expiration (exp) Enforcement: If an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.
• Missing Issued-At (iat) Enforcement: ZITADEL enforces a 1-hour freshness window (maxAge) via the token’s issue time. However, this safety check is guarded by a presence condition. If a token omits the iat claim, the freshness check is entirely bypassed, allowing arbitrarily old tokens to pass.

Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL’s silent acceptance of tokens missing these temporal constraints compromises session integrity.