Threats tagged 'ghsa-j4g7-v4m4-77px'

ZITADEL contains a vulnerability in its federation process that allows an attacker to bypass organization-specific security settings and auto-link an external identity from a deactivated or disallowed identity provider (IdP) to an existing internal user account. This flaw can lead to a full account takeover unless multi-factor authentication (MFA) is enabled on the targeted account. The issue affects multiple versions across v2.x, v3.x, and v4.x releases and has been fixed in later versions.