CVE-2026-109372
Deferred Deferred - Pending Action

Authentication Bypass in ZITADEL via SAML Intent

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109372
EUVD
EUVD-2026-97670

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zitadel zitadel 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZITADEL versions 4.x before 4.19.2 and 3.x through 3.4.15 have an authentication bypass in the SAML identity-provider callback. The system checks the SAML assertion signature using the provider name from the request URL but fails to verify if the user being resolved matches the intended provider. This allows attackers with organization-administrator permissions to register a malicious SAML provider with their own signing key and impersonate any user linked to another SAML provider on the system, including users in different organizations.

Detection Guidance

To detect this vulnerability, check ZITADEL versions for affected releases (3.0.0 to 4.19.1). Verify if public organization registration is enabled on self-hosted instances. Inspect SAML identity provider configurations for unauthorized registrations with custom signing keys. Review login intent callbacks for mismatches between assertion signatures and user resolution.

Impact Analysis

If you use ZITADEL with SAML authentication, an attacker with organization-administrator access could gain unauthorized access to accounts of users from other SAML providers or organizations. This could lead to data breaches, unauthorized actions, or complete account takeover of privileged users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected ZITADEL versions may face compliance violations, potential fines, and reputational damage due to compromised user accounts and data exposure.

Mitigation Strategies

Upgrade ZITADEL to version 4.19.2 or later if using 4.x, or to 3.4.15 or later if using 3.x. This addresses the authentication bypass in the SAML identity-provider intent callback.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart