CVE-2026-109374
Deferred Deferred - Pending Action

Privilege Escalation in ZITADEL via OIDC Token Exchange

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109374
EUVD
EUVD-2026-97672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zitadel zitadel 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109374 is a privilege escalation flaw in ZITADEL versions 3.0.0 through 4.19.1. It allows attackers with specific roles to impersonate administrators, including the IAM_OWNER, by bypassing the admin.impersonation check during OIDC token exchange. This enables unauthorized access to relying applications with elevated privileges.

Detection Guidance

Check ZITADEL version to confirm if it is below 4.19.2. Run: zitadel version. Inspect OIDC token exchange logs for unusual admin impersonation attempts. Look for users with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles performing admin actions.

Impact Analysis

Attackers with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to applications as administrators. They gain access to resources the impersonated administrator can use, though ZITADEL’s own APIs reject these tokens. This could lead to unauthorized data access or actions within relying applications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Unauthorized access may result in data breaches, non-compliance with access control policies, and potential legal penalties.

Mitigation Strategies

Upgrade ZITADEL to version 4.19.2 or later immediately. Disable impersonation features if not required. Revoke IAM_END_USER_IMPERSONATOR and ORG_END_USER_IMPERSONATOR roles from users. Monitor for unauthorized admin impersonation attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart