ZITADEL's OAuth2 Token Exchange endpoint (grant type urn:ietf:params:oauth:grant-type:token-exchange) lacks proper validation to ensure that the incoming access token belongs to or is authorized for the client requesting the exchange. Additionally, it does not enforce that the requested scopes during token exchange remain within the original token's scopes. This allows an attacker with a low-privilege token to obtain a token with elevated permissions for a different, more privileged application, bypassing intended authorization and separation policies. Public clients without client secrets increase the risk. The vulnerability affects versions 3.0.0 through 3.4.12 and 4.0.0 through 4.15.2. The issue is resolved in version 4.15.3 by enforcing strict audience ownership verification and scope restrictions during token exchange.

An attacker with access to a low-privilege token can exploit this vulnerability to escalate privileges by obtaining tokens with administrative roles or access to sensitive data in other applications within the system. This bypasses configured client permissions, project roles, and scope restrictions, potentially leading to unauthorized access and data exposure. The risk is higher for public clients that do not require client authentication.

A fix is available in ZITADEL version 4.15.3 and later; upgrading to these versions is the recommended remediation. If immediate upgrade is not possible, mitigate by disabling the Token Exchange feature flag (ZITADEL_DEFAULTINSTANCE_FEATURES_TOKENEXCHANGE=false) in versions prior to 4.11.0, or by removing the Token Exchange grant type from all configured applications, especially high-privilege or public clients. These mitigations prevent exploitation by disabling or restricting the vulnerable functionality.