{"cve":"CVE-2023-22492","nvd":{"published":"2023-01-11T20:15:08.970","modified":"2026-06-17T05:35:34.783","status":"Modified","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-613"],"references":["https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2","https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8","https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2"],"products":["zitadel:zitadel"],"source":"nvd","synced_at":"2026-10-19T21:37:34.931465858+00:00"},"epss":{"cve":"CVE-2023-22492","score":0.00627,"percentile":0.50056,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6rrr-78xp-5jp8","url":"https://osv.dev/vulnerability/GHSA-6rrr-78xp-5jp8","summary":"Zitadel RefreshToken invalidation vulnerability","modified":"2026-09-10T03:49:51.101862263Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.17.0 <2.17.3"],"fixed":["2.17.3"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.0.0 <2.16.4"],"fixed":["2.16.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}