ZITADEL IdP Email Verification Bypass Leading to Account Takeover (CVE-2024-5666)

Vulnerability Overview Title: Auto-linking by email: IdP-side email verification is not checked Description: Summary: An unauthorized account linking can occur under specific management configurations if the external Identity Provider (IdP) handler allows it. When auto-linking is enabled, ZITADEL checks whether the local user's email has been verified, but it does not explicitly cross-check whether the incoming external IdP has also verified the upstream email address. Impact: When a user logs in via an external Identity Provider, the system may automatically link them to an existing local account if the email addresses match. However, because the system fails to verify whether the external IdP has actually validated ownership of that email address, a security risk is introduced wherein any person connecting with a public provider could potentially gain access. Exploitation Scenario: If an administrator has enabled an external Identity Provider that allows anyone to register with an unverified email address, an attacker can exploit this behavior. By registering an account using the victim's email address, the system will automatically link the attacker's federated identity to the victim's legitimate local account. This allows the attacker to log into the victim's account without any interaction or confirmation. Affected Versions Affected Versions: - 4.x: 4.8.0 to 4.15.2 (including RC versions) - 3.x: 3.9.0 to 3.4.12 (including RC versions) Remediation Patch: - 4.x: Upgrade to 4.15.3 - 3.x: Upgrade to 4.15.3 Workarounds: - If an immediate upgrade is not possible, implement the following mitigation measures: - Disable email-based auto-linking by setting the option. - Audit external IdP configurations and strictly restrict email auto-linking to trusted enterprise identity directories (e.g., corporate Okta or Azure AD) where email verification is strictly managed and enforced by corporate policy. Additional Information CVE ID: CVE-2024-5666 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None Weakness: CWE-287 Credits: - Android-Login-Analysis: Reporter - Ivivo-a: Fix Developer - IAM-marco: Fix Reviewer Questions: - If you have any questions or comments, please contact us at security@zitadel.com. Acknowledgments: - Thank you to Android-Login-Analysis for reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL IdP Email Verification Bypass Leading to Account Takeover (CVE-2024-5666)

More from this source