ZITADEL Forgeable IdP Intent Tokens Leading to Session Hijacking and Token Theft

Vulnerability Overview Title: Cross-user session hijacking and external IdP token theft via forgeable IdP intent tokens Description: After a user logs in via an external Identity Provider (IdP), ZITADEL issues an IdP intent token to the login UI. This token, along with an intent identifier, is used to retrieve the results of the external login and verify the user’s identity. These tokens are protected by an unencrypted, malleable encryption mode, meaning their integrity is not cryptographically verified upon redemption. Impact: An attacker who holds a valid account and can predict a victim’s external login intent identifier within a short timeframe may: Read another user’s external login results, including IdP access, ID, and refresh tokens. Hijack the victim’s pending session by consuming the successful intent and obtaining a session that ZITADEL considers authenticated. Severity: High (7.7 / 10) Affected Versions Affected Versions: - 4.x: 4.0.0 through 4.17.2 (including Release Candidate versions) - 3.x: 3.0.0 through 3.4.15 (including Release Candidate versions) Remediation Patches: - Upgrade to version 4.17.3 or later. - Version 3.x reached end-of-life on 2026-08-31 and will not receive a patch for this vulnerability. Affected 3.x deployments must upgrade to version 4.x. Workarounds: - Upgrading to the patched version is the recommended solution. - Partial mitigation: Self-hosted deployments should implement strict rate limiting and bot protection in front of the API (as per ZITADEL’s production checklist). This reduces the likelihood of a successful attack but does not eliminate it entirely. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Changed - Confidentiality: High - Integrity: High - Availability: None CVE ID: No known CVE Weaknesses: - CWE-339 - CWE-347 Credits: - Discoverer: livio-a (Remediation developer) - Reviewer: wim07101993 (Remediation reviewer) Contact: - For any questions or comments, please email security@zitadel.com Acknowledgments: - The vulnerability was discovered during a scheduled penetration test by zentrunt partners GmbH. Thanks to analysts Martin Tschirsich and Joud Zaharia. - The full report will be made public after the review process is complete.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL Forgeable IdP Intent Tokens Leading to Session Hijacking and Token Theft

More from this source