Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

ZITADEL lets admins hijack users through SAML

CVE-2026-109372 · published 13 days ago
Summary

In ZITADEL versions before 4.19.2, an admin can add a fake SAML login provider and then gain access to any other user's account, even across different organizations. This happens because the system does not verify that the user belongs to the SAML provider that signed the login request. Administrators should upgrade ZITADEL to the latest version or apply the provided patch to stop this behavior.

What to do
  • Update zitadel zitadel to version 4.19.2 or later.
Affected software
VendorProductAffected versions
zitadel zitadel < 4.19.2
Original advisory text
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published12 Oct 2026
Updated26 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109372 · NVD
CVE-2026-109372 · OSV
GHSA-x4c7-fpcx-w9q6 · GHSA
CVE-2026-109372 · MITRE
Track software like this
Free during beta