Lucasdodgson

The Login V2 UI is susceptible to host header injection. Unauthenticated attackers can poison password-reset, invite, and email-verification links by providing untrusted values in the `x-zitadel-public-host`, `x-zitadel-forward-host`, or `x-forwarded-host` headers. If an attacker knows a victim's login name, they can redirect links in legitimate emails to a host under their control to harvest single-use codes and take over accounts, including those of instance administrators.

Login V2 contains a missing authorization issue that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without their consent. By sending a signed-in user a link containing the attacker's user code, an attacker can obtain the victim's tokens and bypass project access settings via the OIDC device authorization API.

An authentication bypass exists in the Login V2 UI. Unauthenticated attackers can obtain session tokens of other users by forging unsigned session cookies. By guessing time-ordered session IDs associated with a victim's sign-in and providing empty tokens, attackers can receive rotated tokens. This allows for full account takeover, including sessions for administrators that have already completed Multi-Factor Authentication (MFA), a security process requiring two or more verification factors.

An authentication bypass exists in the hosted Login V1 and Login V2 UIs. The system allows the enrollment of a passkey or other authenticator during identify-only login sessions before a primary factor is verified. An unauthenticated attacker who knows a victim's login name can register an attacker-controlled authenticator to gain unauthorized access to the account, bypassing passwords and multi-factor authentication (MFA).

An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission. This occurs during identify-only Login V2 sessions and via the User Service V2 'AddIDPLink' endpoint. An unauthenticated attacker who knows a victim's login name can bind their own external identity provider identity to the victim's account to hijack it and sign in as the victim.

A missing authentication flaw exists in the hosted Login V1 UI. The second-factor enrollment and initialization handlers process identify-only sessions before the primary factor is verified. An attacker with knowledge of a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users by analyzing discrepant error messages.

An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain One-Time Password (OTP) codes through the `returnCode` delivery type by reading them from server-action responses. This allows the attacker to establish MFA-authenticated sessions, which may include the takeover of administrator accounts.

ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2 format truncated to 80 characters are considered valid. Zitadel uses symmetric AES encryption for opaque tokens, and the cleartext payload includes a token ID and user ID. Version 2 tokens distinguish the token ID as `v2 <oidc session id>-at <access token id>`. When tokens are truncated, the `user id` is missing from the cleartext. The back-end still accepts these truncated tokens because it relies on session data from the database for user identification in v2 tokens. The patch in versions 4.11.0 and 3.4.7 resolves the issue by verifying the `user id` from the token against the session data in the database.