Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

ZITADEL allows session hijacking through forged login tokens

CVE-2026-105208 · published 14 days ago
Summary

ZITADEL versions before 4.17.3 let a logged‑in user modify their own login token so it can be used for another person's external login. This can let an attacker guess a token, race the request, and take over the victim's session. Update ZITADEL to the latest version or apply the provided patch to stop the token manipulation.

Original advisory text
ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
Timeline
Published4 Oct 2026
Updated9 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105208 · NVD
CVE-2026-105208 · OSV
GHSA-jh3m-cr2x-qp88 · GHSA
Track software like this
Free during beta