CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Organization administrators can hijack user accounts across organizations by exploiting SAML identity-provider confusion in ZITADEL.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109372?
CVE-2026-109372 is a critical authentication bypass vulnerability in zitadel, published on 12 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Weakness: CWE-287
Which versions are affected by CVE-2026-109372?
How do I fix CVE-2026-109372?
No fix has been published for CVE-2026-109372 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-109372 being exploited?
There is no known exploitation of CVE-2026-109372 in the wild and no public exploit code.
Sources
Also known as GHSA-65fv-6pff-4q47, GHSA-x4c7-fpcx-w9q6.