CVE-2026-109374

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.19.1

Description A privilege escalation issue exists in the OIDC token exchange process. This flaw allows users with IAM END USER IMPERSONATOR or ORG END USER IMPERSONATOR roles to bypass the admin.impersonation check. Consequently, these users can impersonate administrators, including those with the IAM OWNER role, and sign in to relying applications with administrative roles and claims.

Recommendations Update ZITADEL to version 4.19.2 or later.