What’s Vulnerable › Vulnerabilities

CVE-2026-109372: ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-287

Description

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

Affected products

• zitadel: from 3.0.0 before 4.19.2 — fixed in 4.19.2

How to fix

Upgrade to a fixed version: zitadel 4.19.2. Check the vendor advisory for mitigations.

References

• https://github.com/zitadel/zitadel/security/advisories/GHSA-x4c7-fpcx-w9q6
• https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-saml-identity-provider-confusion

Get alerted when CVE-2026-109372 or the next vulnerability affects your stack