CVE-2026-105208: ZITADEL Auth Bypass Vulnerability

CVE-2026-105208 Overview

CVE-2026-105208 is a session hijacking vulnerability in ZITADEL, an open-source identity and access management platform. The flaw affects ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15. ZITADEL protects Identity Provider (IdP) intent tokens using unauthenticated, malleable encryption. Authenticated users can tamper with their own intent tokens so the modified tokens are accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal IdP tokens or hijack sessions. The weakness maps to [CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking].

Critical Impact

Authenticated attackers can hijack another user's external login session and steal IdP tokens by forging intent tokens that ZITADEL accepts as valid.

Affected Products

• ZITADEL 4.x versions prior to 4.17.3
• ZITADEL 3.x versions through 3.4.15
• Deployments exposing /v2/idp_intents and /v2/sessions endpoints

Discovery Timeline

• 2026-10-04 - CVE-2026-105208 published to NVD
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105208

Vulnerability Analysis

ZITADEL uses IdP intent tokens to track external authentication flows with providers such as OIDC, SAML, or social identity systems. The platform encrypts these tokens before returning them to the client. The encryption lacks authentication, meaning the ciphertext carries no integrity tag. An authenticated user who holds a valid token for their own intent can modify the ciphertext to reference another user's intent identifier. ZITADEL decrypts the forged token and accepts it when the client calls /v2/idp_intents to retrieve IdP tokens or /v2/sessions to establish a session.

Exploitation requires the attacker to predict the victim's in-flight intent identifier and to submit the forged request before the legitimate flow completes. The attack vector is network-based, requires low privileges, and depends on user interaction from the victim initiating an external login.

Root Cause

The root cause is malleable encryption applied to security-relevant data without an integrity check. ZITADEL treats decryption success as proof of authenticity. Because the cipher mode permits ciphertext modification without detection, attackers can alter plaintext fields such as the intent identifier. The design violates the principle that encryption alone does not provide integrity, which is the exact failure pattern described by CWE-649.

Attack Vector

An authenticated attacker first starts their own legitimate IdP intent and captures the returned encrypted token. The attacker then identifies or predicts an in-flight intent identifier belonging to a victim. The attacker modifies the ciphertext to substitute the victim's intent identifier and submits the forged token to /v2/idp_intents or /v2/sessions. Winning the race against the victim's legitimate completion yields the victim's IdP tokens or an authenticated session as the victim. No verified public exploit code is available. See the GitHub Security Advisory GHSA-jh3m-cr2x-qp88 and the VulnCheck Zitadel Session Hijacking Advisory for additional technical analysis.

Detection Methods for CVE-2026-105208

Indicators of Compromise

• Repeated or anomalous POST requests to /v2/idp_intents or /v2/sessions from a single authenticated principal targeting multiple intent identifiers.
• Successful IdP intent completions where the authenticated caller does not match the user who initiated the external login flow.
• Session creation events immediately followed by access to resources owned by a different user account.

Detection Strategies

• Correlate IdP intent initiation events with completion events and alert when the initiating subject differs from the completing subject.
• Baseline the rate of /v2/idp_intents and /v2/sessions calls per user and flag spikes consistent with brute-force intent identifier guessing.
• Monitor ZITADEL audit logs for decryption of intent tokens tied to intents the caller did not create.

Monitoring Recommendations

• Forward ZITADEL application and audit logs to a centralized analytics platform for correlation across sessions, intents, and user accounts.
• Enable alerting on short-interval, high-volume requests to IdP intent endpoints from the same source IP or user agent.
• Review authentication telemetry for sessions created without a matching user-driven login sequence.

How to Mitigate CVE-2026-105208

Immediate Actions Required

• Upgrade ZITADEL 4.x deployments to version 4.17.3 or later without delay.
• Upgrade ZITADEL 3.x deployments to a fixed release beyond 3.4.15 as published by the vendor.
• Invalidate active sessions and rotate IdP client secrets after patching to remove any sessions created through exploitation.
• Audit recent /v2/idp_intents and /v2/sessions activity for signs of intent identifier guessing or cross-user completions.

Patch Information

The vendor fixed the vulnerability in ZITADEL 4.17.3. Administrators running 3.x branches should consult the GitHub Security Advisory GHSA-jh3m-cr2x-qp88 for the exact 3.x patched version and upgrade guidance. The fix introduces authenticated encryption for IdP intent tokens so that any tampering is detected during decryption.

Workarounds

• Restrict network access to ZITADEL management APIs to trusted administrative networks until patching completes.
• Reduce the time window for intent race conditions by lowering IdP intent token lifetimes where configurable.
• Enforce short-lived sessions and multi-factor authentication on all accounts to limit the value of hijacked sessions.

# Example upgrade for container deployments
docker pull ghcr.io/zitadel/zitadel:v4.17.3
docker stop zitadel && docker rm zitadel
docker run -d --name zitadel \
  -p 8080:8080 \
  ghcr.io/zitadel/zitadel:v4.17.3 start-from-init