Iam-Marco

An authentication bypass exists in the Login V2 UI that allows unauthenticated attackers to take over accounts of users who have not yet configured any authentication method. By computing a valid `verificationCheck` cookie using the user ID and browser fingerprint, an attacker can set a password, register a passkey, or link an identity provider for the target account.

Login V2 contains a missing authorization issue that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without their consent. By sending a signed-in user a link containing the attacker's user code, an attacker can obtain the victim's tokens and bypass project access settings via the OIDC device authorization API.

The hosted Login V1 UI contains a flaw where the change-username handler processes requests for the account associated with a login flow before verifying any authentication factors. This allows unauthenticated attackers to provide a victim's login name and submit a new username to rename any active human user, including administrators, which results in the users being locked out of their accounts.

An authentication bypass exists in the SAML identity-provider intent callback. The system verifies the assertion signature using the provider specified in the request URL but resolves the user from the login intent without ensuring they match. This allows attackers with organization-administrator permissions to register a SAML provider using their own signing key to gain authenticated sessions as any user linked to another SAML provider on the instance, regardless of their organization.

A privilege escalation issue exists in the OIDC token exchange process. This flaw allows users with `IAM END USER IMPERSONATOR` or `ORG END USER IMPERSONATOR` roles to bypass the `admin.impersonation` check. Consequently, these users can impersonate administrators, including those with the `IAM OWNER` role, and sign in to relying applications with administrative roles and claims.

An authentication bypass exists in the hosted Login V1 UI. The issue occurs because the registration endpoint for external accounts not found trusts external identity fields provided by the client without requiring a completed Identity Provider (IdP) callback. An unauthenticated attacker can submit forged `IDPConfigID` and `ExternalUserID` values to pre-create an account linked to a victim's external IdP identity. When the victim subsequently performs a legitimate external login, they are signed into the pre-created account.

An incorrect authorization flaw exists in the User Service API. The system verifies the `user.read` permission against the caller's organization instead of the organization that owns the target user. An authenticated member with org-scoped `user.read` permissions can use the 'GET /v2/users/{userId}/authentication methods' endpoint to identify the authentication method types registered by users in other organizations.

An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the `x-zitadel-orgid` header but fails to verify the organization of the target user. This allows an attacker with user-write permissions in one organization to obtain an enrollment code for a user belonging to a different organization on the same instance, enabling the attacker to register their own authenticator and take over the account.

An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain One-Time Password (OTP) codes through the `returnCode` delivery type by reading them from server-action responses. This allows the attacker to establish MFA-authenticated sessions, which may include the takeover of administrator accounts.

An authentication bypass exists in the hosted Login V1 and Login V2 UIs. The system allows the enrollment of a passkey or other authenticator during identify-only login sessions before a primary factor is verified. An unauthenticated attacker who knows a victim's login name can register an attacker-controlled authenticator to gain unauthorized access to the account, bypassing passwords and multi-factor authentication (MFA).

An issue exists where the server can be coerced into making requests to internal resources during organization domain HTTP verification. This occurs because the challenge fetch process utilizes the default `http.Get` function in Go instead of a protected client. Attackers can register domains that redirect to loopback, internal, or cloud metadata addresses, enabling them to scan ports and map internal networks. This is a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

ZITADEL is an open source identity management platform. A user enumeration issue exists in the login interfaces. An unauthenticated attacker can determine the existence of valid user accounts by attempting different usernames and userIDs. The vulnerability is exploitable by iterating through usernames and `userIDs`.