ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the… (CVE-2026-109372)

CVE-2026-109372 describes an authentication bypass in ZITADEL's SAML identity-provider intent callback for versions 4.x before 4.19.2 and 3.x through 3.4.15. The vulnerability occurs because the verification process checks the assertion signature against the provider specified in the request URL but does not confirm that the user resolved from the login intent corresponds to that provider. Consequently, an attacker with organization-administrator privileges can register a SAML provider with their own signing key and impersonate any user linked to a different SAML provider on the same instance, potentially across organizational boundaries.

This vulnerability allows attackers with organization-administrator permissions to bypass authentication controls and gain unauthorized access as any user associated with other SAML providers on the instance. The impact includes full compromise of user sessions and potential cross-organization access, leading to confidentiality and integrity violations. The CVSS 3.1 score is 8.7 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts.

A fix is available in ZITADEL version 4.19.2 and later for the 4.x branch, and versions after 3.4.15 for the 3.x branch. Users should upgrade to these fixed versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds.