CVE-2026-105208

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.x through 4.17.2 ZITADEL versions 3.x through 3.4.15

Description Authenticated users can tamper with their own IdP intent tokens due to the use of unauthenticated, malleable encryption. This allows a user to modify a token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can use the '/v2/idp intents' or '/v2/sessions' endpoints to steal IdP tokens or hijack a session.

Recommendations Update ZITADEL versions 4.x to 4.17.3 or later. Update ZITADEL versions 3.x to 3.4.16 or later.