Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-109372 EUVD-2026-97670GHSA-65fv-6pff-4q47

ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

Published Oct 12, 2026 · Updated Oct 13, 2026 · Assigned by VulnCheck

Vendor: zitadel Product: zitadel

Description

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

Affected products

VendorProductAffectedFixed
zitadel zitadel 3.0.0 – < 4.19.2 4.19.2

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References