{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T08:12:45.999","vulnerabilities":[{"cve":{"id":"CVE-2023-22492","sourceIdentifier":"security-advisories@github.com","published":"2023-01-11T20:15:08.970","lastModified":"2024-11-21T07:44:55.083","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. "},{"lang":"es","value":"ZITADEL es una combinación de Auth0 y Keycloak. RefreshTokens es una característica de OAuth 2.0 que permite a las aplicaciones recuperar nuevos tokens de acceso y actualizar la sesión del usuario sin la necesidad de interactuar con una interfaz de usuario. Los RefreshTokens no se invalidaban cuando un usuario era bloqueado o desactivado. El usuario desactivado o bloqueado pudo obtener un token de acceso válido solo mediante una concesión de token de actualización. Cuando la sesión del usuario bloqueado o desactivado ya había finalizado (“logged out”) no era posible crear una nueva sesión. La renovación del token de acceso mediante una concesión de token de actualización está limitada a la cantidad de tiempo configurada (RefreshTokenExpiration). Como workaround, asegúrese de que RefreshTokenExpiration en la configuración OIDC de su instancia esté configurado de acuerdo con sus requisitos de seguridad. Este problema se solucionó en las versiones 2.17.3 y 2.16.4."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.16.4","matchCriteriaId":"0656FCDD-D804-476F-B8F8-4BB6845B622A"},{"vulnerable":true,"criteria":"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.17.0","versionEndExcluding":"2.17.3","matchCriteriaId":"52C4BACF-5AB3-4DBF-865D-E0FC740C379C"}]}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}}]}