CVE-2026-27840: 
NixOS vulnerability analysis and mitigation

CVE-2026-27840 is a vulnerability in ZITADEL, an open-source identity management platform, where opaque OIDC access tokens in v2 format truncated to 80 characters are still accepted as valid by the backend. It affects versions 2.31.0 through 2.71.19, 3.0.0 through 3.4.6, and 4.0.0 through 4.10.1. The vulnerability was disclosed on February 25, 2026, and has a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly). The ZITADEL maintainers explicitly note this issue is not considered exploitable but may appear anomalous when reproduced (GitHub Advisory).

The root cause is classified as CWE-302 (Authentication Bypass by Assumed-Immutable Data). ZITADEL uses symmetric AES encryption for opaque tokens; v2 token cleartext payloads follow the format v2_<oidc_session_id>-at_<access_token_id>:<user_id>. When a v2 token is truncated to 80 characters, the user_id portion is dropped from the cleartext, but the backend still validates the token because v2 token authorization retrieves session data — including the authoritative user_id — from the database rather than from the token payload itself, making the missing user_id field non-fatal to validation (GitHub Advisory). The fix, introduced in commit feab8e1, passes the subject from the token into verifyAccessTokenV2 and explicitly compares it against the UserID retrieved from the database, rejecting any mismatch (Patch Commit).

The practical impact of this vulnerability is limited to a low-severity integrity concern: a truncated v2 token — which would normally be considered malformed — is accepted as valid by the ZITADEL backend. There is no confidentiality impact (no data exposure) and no availability impact. Because the user_id is sourced from the database session record rather than the token itself in v2 flows, there is no demonstrated path to privilege escalation, impersonation, or unauthorized access to other users' sessions (GitHub Advisory).

The vulnerability is not considered exploitable by the ZITADEL maintainers, and no public proof-of-concept exploit code, exploit kits, or in-the-wild exploitation have been reported (GitHub Advisory). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), reflecting a very low probability of exploitation (Feedly). No threat actor attribution has been identified.

ZITADEL has released patched versions that resolve the issue by verifying the user_id from the token against the session data in the database. Users should upgrade to the following versions: 4.x: upgrade to ≥4.11.0; 3.x: upgrade to ≥3.4.7; 2.x: upgrade to ≥3.4.7 (GitHub Advisory, v3.4.7 Release, v4.11.0 Release). No configuration-based workarounds are available; upgrading is the only remediation (GitHub Advisory).

The vulnerability was reported by Olivier Becker and Lucas Dodgson and coordinated through ZITADEL's security team (GitHub Advisory). The ZITADEL maintainers were transparent in their advisory, explicitly stating the issue is not considered exploitable while still issuing patches promptly. Community reaction has been minimal given the low severity and non-exploitable nature of the finding.