CVE-2026-109372

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.x through 4.19.1 ZITADEL versions 3.x through 3.4.15

Description An authentication bypass exists in the SAML identity-provider intent callback. The system verifies the assertion signature using the provider specified in the request URL but resolves the user from the login intent without ensuring they match. This allows attackers with organization-administrator permissions to register a SAML provider using their own signing key to gain authenticated sessions as any user linked to another SAML provider on the instance, regardless of their organization.

Recommendations Update ZITADEL versions 4.x to 4.19.2 or later. Update ZITADEL versions 3.x to 3.4.16 or later.