CVE-2026-109372: ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZITADELto a version that resolves this vulnerability.Fixed in 4.19.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs organization-administrator permission on the ZITADEL instance. They must be able to register a SAML identity provider using a signing key they control.
Which accounts are at risk of takeover?
Any user linked to a different SAML provider on the same instance may be impersonated. The affected user can be in another organization, so organization boundaries do not prevent this impact.
What versions are affected?
Affected versions are ZITADEL 4.x before 4.19.2 and ZITADEL 3.x through 3.4.15. Updating 4.x deployments to 4.19.2 or later addresses the stated affected range.
What can be done before an update is available or feasible?
Restrict organization-administrator permissions and prevent untrusted administrators from registering SAML identity providers. Review existing SAML provider registrations, especially providers with unexpected signing keys, because exploitation requires an attacker-controlled provider.