CVE-2026-105208: ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-04 · updated 2026-10-29
Weakness: CWE-649

Description

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.

Affected products

zitadel: from 4.0.0 before 4.17.3 — fixed in 4.17.3

How to fix

Upgrade to a fixed version: zitadel 4.17.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-105208 or the next vulnerability affects your stack