Description
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zitadel | zitadel | < 4.17.1 | 4.17.1 |
References
- GitHub Security Advisory (GHSA-558c-v5wc-9w4q) vendor-advisory
- VulnCheck Advisory: ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations third-party-advisory