ZITADEL Login V1 Unauthenticated Account Pre-Hijacking via Forged IdP Callback

Vulnerability Overview Title: Unauthenticated Account Pre-Hijacking via Forged External Identity Provider Callback in Login V1 Description: The Login V1 UI, powered by ZITADEL, allows unauthenticated attackers to create user accounts by forging callbacks from external identity providers (IdPs). An attacker can pre-create an account; when a victim attempts to log in using the same public external user ID, the attacker can seize control of that account. Affected Versions Affected Versions: - 4.x: 4.0.0 - 4.16.1 - 3.x: 3.0.0 - 3.4.13 Impact: - Attackers can create user accounts without requiring a genuine IdP login. - Attackers can bind accounts to externally chosen IdP identities. - Attackers can pre-create accounts, allowing them to hijack the account when the victim logs in via an external IdP for the first time. Remediation Patches: - Upgrade to version 4.16.2 or later. - Upgrade to version 3.4.14 or later. Workarounds: - Disable the "Allow manual account creation" option. - Disable the "Automatic account creation" option. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None CVE ID: No known CVE Weaknesses: No known weaknesses Credit: - Reporters: Ibonak, AdamKorcz - Fix Reviewer: Ilivo-a - Coordinator: IAM-marco Questions If you have any questions or comments, please email security@zitadel.com. Credits Thanks to Michael Wollner and Adam Karczynski for reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL Login V1 Unauthenticated Account Pre-Hijacking via Forged IdP Callback

More from this source