GHSA-qj3q-235g-qr6w: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

Published Oct 29, 2026

Updated

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker needs to send a signed-in user a link containing the attacker’s OAuth 2.0 device user code. If the victim follows the link, the attacker can approve the device authorization using the victim’s existing session and obtain that victim’s tokens.

Are deployments with project access restrictions protected?

No. The issue can bypass project access settings through the OIDC device authorization API, so those settings do not prevent exploitation of this vulnerability.

Which versions are affected?

Affected versions are ZITADEL 3.0.0 through 3.4.15 and ZITADEL 4.0.0 before 4.19.5. The provided data does not identify mitigations other than using a version outside those affected ranges.

GHSA-qj3q-235g-qr6w: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are deployments with project access restrictions protected?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are deployments with project access restrictions protected?

Which versions are affected?