{"id":"CVE-2023-22492","aliases":["EUVD-2023-0370","GHSA-6rrr-78xp-5jp8"],"status":"published","title":"RefreshToken invalidation vulnerability","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00627,"percentile":0.50384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2023-01-11T18:27:48Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"Go","package":"github.com/zitadel/zitadel","fixed_in":["2.17.3","2.16.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.17.0"},{"fixed":"2.17.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.16.4"}]}]}],"products":[{"vendor":"zitadel","product":"zitadel"}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.16.4","tags":["web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.17.3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22492","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6rrr-78xp-5jp8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22492.json","tags":["advisory"]},{"url":"https://github.com/zitadel/zitadel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-22492","title":"RefreshToken invalidation vulnerability","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. ","status":"published","published":"2023-01-11T19:42:50.505Z","modified":"2025-03-10T21:30:41.038Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-0370","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. ","status":"published","published":"2023-01-11T19:42:50Z","modified":"2025-03-10T21:30:41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:08.584552Z"}],"ghsa":[{"id":"GHSA-6rrr-78xp-5jp8","title":"Zitadel RefreshToken invalidation vulnerability","description":"### Impact\nRefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI.\n\nRefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.\n\nWhen the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).\n\n### Patches\n2.x versions are fixed on \u003e= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3)\n2.16.x versions are fixed on \u003e= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\nEnsure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.\n\n### References\n\nhttps://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration\n","status":"published","published":"2023-01-11T18:27:48Z","modified":"2023-01-24T18:55:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:36:14.825433Z"}],"nvd":[{"id":"CVE-2023-22492","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. ","status":"published","published":"2023-01-11T20:15:08.97Z","modified":"2026-06-17T05:35:34.783Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"CVE-2023-22492","title":"RefreshToken invalidation vulnerability","description":"ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. ","status":"published","published":"2023-01-11T19:42:50.505Z","modified":"2026-10-28T02:30:37.900753323Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"GHSA-6rrr-78xp-5jp8","title":"Zitadel RefreshToken invalidation vulnerability","description":"### Impact\nRefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI.\n\nRefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.\n\nWhen the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).\n\n### Patches\n2.x versions are fixed on \u003e= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3)\n2.16.x versions are fixed on \u003e= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\nEnsure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.\n\n### References\n\nhttps://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration\n","status":"published","published":"2023-01-11T18:27:48Z","modified":"2026-09-10T03:49:51.101862263Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}