CVE-2026-109374: ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must hold either the IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role. Those roles can be used to sign in to relying applications while impersonating administrators, including IAM_OWNER.
What versions are affected?
ZITADEL versions from 3.0.0 before 4.19.2 are affected. Version 4.19.2 is not listed as affected.
What is the practical impact on relying applications?
A successful attacker can obtain an administrator's roles and claims when signing in to relying applications through OIDC token exchange. This can extend the impact beyond the impersonation capability itself to any application that trusts those administrator claims.