Zitadel RefreshToken invalidation vulnerability (CVE-2023-22492)

Zitadel RefreshToken invalidation vulnerability (CVE-2023-22492) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/zitadel/zitadel (go), github.com/zitadel/zitadel (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/zitadel/zitadelgo	>=2.17.0 <2.17.3	2.17.3
github.com/zitadel/zitadelgo	>=2.0.0 <2.16.4	2.16.4

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/zitadel/zitadel, github.com/zitadel/zitadel.
Review the reported fix. Update github.com/zitadel/zitadel to 2.17.3; github.com/zitadel/zitadel to 2.16.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jan 11, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). ### Patches 2.x versions are fixed on >= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3) 2.16.x versions are fixed on >= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4) ZITADEL recommends upgrading to the latest versions available in due course. ### Workarounds Ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. ### References https://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration

Quoted source text, attributed separately from HOL analysis.