ZITADEL: Authentication bypass in SAML identity provider callback
Summary
ZITADEL has an authentication bypass in the SAML identity provider intent callback used by Login V2 and custom login UIs. An attacker who holds organization-administrator permission can register a SAML identity provider with a signing key they control and obtain an authenticated session as any user linked to a different SAML provider on the same instance, including users in other organizations. The issue requires an instance with at least two SAML identity providers and does not by itself grant administrative rights.
Affected
- ZITADEL 4.0.0 through 4.19.1 (including RC versions)
- ZITADEL 3.0.0 through 3.4.15 (including RC versions)
- Relevant only on instances with two or more SAML identity providers
Fixed in
- 4.x: upgrade to 4.19.2 or later
- 3.x: no fix; the 3.x line reached end of life on 2026-08-31, so upgrade to a patched 4.x release
Workaround
- No configuration fully closes the issue on unpatched versions.
- Self-hosted deployments can disable public organization registration (DisallowPublicOrgRegistration) to remove the unauthenticated path to organization-administrator permission. This does not address existing organization administrators.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No exploitation in the wild was found in the sources; this is not a confirmed negative.
Our recommendation
- Identify all ZITADEL instances and their versions.
- Upgrade 4.x instances to 4.19.2 or later.
- Migrate 3.x instances to a patched 4.x release, because 3.x receives no fix.
- Review SAML identity provider configurations and organization-administrator assignments for unexpected entries.
- Limit organization-administrator rights to the minimum needed and monitor changes to identity providers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x4c7-fpcx-w9q6 github.com
- VulnCheck advisory: ZITADEL account takeover via SAML identity provider confusion www.vulncheck.com
- OSV entry CVE-2026-109372 osv.dev
- ZITADEL GitHub releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:27.
Original description (NVD)
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.