ZITADEL Unauthenticated Account Takeover via Unverified External Identity Linking

Vulnerability Overview Title: Unauthenticated Account Takeover Through External Identity Provider with Account Manual Linking enabled Description: ZITADEL establishes links between user accounts and external identity providers without verifying whether the requester is authorized to create such links. Affected versions include 4.0.0 - 4.17.2 and 3.0.0 - 3.4.15. Impact: An attacker can bind their external identity to a victim's account by leveraging the explicit linking flow in Login V2. An attacker can log in as the victim by authenticating through the provider, thereby obtaining a fully authenticated session. Through the API surface, an attacker can pre-claim an external identity, causing the victim's future federated login attempts to fail. Remediation: Upgrade to version 4.17.3 or later. For the 3.x series, upgrade to version 3.4.15 (including release candidates). Affected Versions Affected Versions: - 4.x: 4.0.0 to 4.17.2 (including release candidates) - 3.x: 3.0.0 to 3.4.15 (including release candidates) Remediation Upgrade: - Upgrade to version 4.17.3 or later. - For the 3.x series, upgrade to version 3.4.15 (including release candidates). Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: No known CVE Weaknesses: - CWE-306 - CWE-862 Contributors: - lucasdodson (Reporter) - AdamKorcz (Reporter) - grvjayan (Remediation developer) - livio-a (Remediation reviewer) Questions For any questions or comments, please send an email to security@zitadel.com. Acknowledgments Thanks to Lucas Dodson from Intigriti Labs and Adam Korczynski from Ada Logics for discovering and reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL Unauthenticated Account Takeover via Unverified External Identity Linking

More from this source