CVE-2026-109372— ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Quick assessment
Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ZITADEL 4.x 在 4.19.2 版本之前，以及 3.x 到 3.4.15 版本之间，在 SAML 身份提供者（Identity Provider）意图回调中存在身份验证绕过漏洞。该回调在处理时，使用请求 URL 中指定的提供商名称来验证断言（assertion）的签名，但在解析用户身份时却直接从登录意图（login intent）中提取，而未验证签名所对应的身份提供者是否与意图中的身份提供者一致。 拥有组织管理员权限的攻击者可以注册一个使用自有签名密钥的 SAML 身份提供者，从而冒充该 SAML 身份提
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109372
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109372
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109372
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109372 (2)
Same Patch Batch · zitadel · 2026-10-12 · 4 CVEs total
| CVE-2026-109371 | 8.2 HIGH | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 |
| CVE-2026-109373 | 8.1 HIGH | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie |
| CVE-2026-109374 | 5.5 MEDIUM | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation |
IV. Related Vulnerabilities
Same product: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Lo -
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same vendor: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Lo -
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same weakness: CWE-287
-
CVE-2026-110097
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Te -
CVE-2026-53709
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped -
CVE-2026-93907
IBM WebSphere Application Server is affected by a bypass aut -
CVE-2026-95680
IBM WebSphere Application Server is affected by an authoriza -
CVE-2026-109114
AdithyaYelloju Restaurant-Management-System Login Form login
V. Comments for CVE-2026-109372
No comments yet