Zitadel's OAuth2/OIDC CodeExchange and RefreshToken flows fail to validate that the client requesting token exchange matches the client that initiated the authorization, violating RFC 6749 Section 4.1.3. This flaw enables attackers who have intercepted authorization codes or refresh tokens to exchange them under different client credentials, bypassing intended client boundaries. The vulnerability affects Zitadel versions 3.0.0 through 3.4.11 and 4.0.0 through 4.15.1. Exploitation requires an external vulnerability or data leak to obtain tokens. PKCE partially mitigates authorization code injection but not refresh token cross-use. The issue is resolved by reintroducing strict client identity validation in versions 3.4.12 and 4.15.2 and later.

An attacker who intercepts an authorization code or refresh token can use it with a different client identity registered on the same Zitadel instance, potentially obtaining unauthorized access tokens for victim users. This breaks client isolation and can lead to unauthorized access across tenants in multi-tenant deployments. Exploitation requires prior compromise or token leakage outside Zitadel. PKCE mitigates some attack vectors but does not protect refresh token misuse. The vulnerability can lead to high confidentiality and integrity impact but does not affect availability.

A fix is available. Upgrade Zitadel to version 3.4.12 or later for the 3.x series, or 4.15.2 or later for the 4.x series to restore strict client identity validation on authorization code and refresh token exchanges. Until patched, enforce PKCE for all clients to mitigate authorization code injection risks, minimize refresh token lifespans, and maintain strong application security to prevent token theft. No other workarounds fully address the vulnerability.