CVE-2026-109372: ZITADEL SAML Authentication Bypass Flaw

CVE-2026-109372 Overview

CVE-2026-109372 is an authentication bypass vulnerability in ZITADEL, an open-source identity and access management platform. The flaw resides in the Security Assertion Markup Language (SAML) identity-provider intent callback. ZITADEL verifies the SAML assertion signature using the provider named in the request URL but resolves the user from the login intent without confirming the two match. An organization administrator can register a SAML provider using their own signing key and obtain authenticated sessions as any user linked to another SAML provider on the instance, including users in other organizations. The weakness is tracked under CWE-287.

Critical Impact
An attacker with organization-administrator permission on a single tenant can impersonate any SAML-linked user across the entire ZITADEL instance, enabling cross-organization account takeover.

Affected Products

ZITADEL 4.x versions before 4.19.2
ZITADEL 3.x versions through 3.4.15
Multi-tenant ZITADEL deployments using SAML identity providers

Discovery Timeline

2026-10-12 - CVE-2026-109372 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109372

Vulnerability Analysis

ZITADEL supports federated authentication through SAML identity providers (IdPs). When a user completes a SAML flow, ZITADEL processes an intent callback that validates the IdP's assertion and links the authenticated identity back to a login intent. The callback logic splits responsibility: signature verification uses the provider referenced in the request URL, while user resolution relies on the previously created login intent. These two sources are never compared.

An organization administrator can exploit this split by registering a SAML IdP under their own control, including the signing certificate. They then initiate a login intent for a target user that is actually federated with a different, legitimate SAML provider. The callback accepts the attacker-signed assertion as valid because it is checked against the attacker's own provider, yet the session is bound to the target user from the intent. The result is an authenticated session as the target principal, including users in unrelated organizations.

Root Cause

The root cause is missing authorization binding between the SAML provider that signed the assertion and the user record resolved from the login intent. The code enforces cryptographic integrity but not the identity association that signature verification is meant to prove.

Attack Vector

Exploitation requires network access to the ZITADEL instance and administrator privileges within any single organization. The attacker configures a malicious SAML IdP, crafts a login intent targeting a victim account, and submits an assertion signed with their own key. No user interaction is required. Because ZITADEL is often deployed as a shared identity backbone, a single compromised tenant admin can pivot to privileged accounts across the entire instance.

See the ZITADEL GitHub Security Advisory GHSA-x4c7-fpcx-w9q6 and the VulnCheck Advisory on ZITADEL for additional context.

Detection Methods for CVE-2026-109372

Indicators of Compromise

SAML identity providers created shortly before successful authentication events against high-value accounts linked to a different IdP.
Login intent callbacks where the provider referenced in the request URL does not match the historical IdP associated with the resolved user.
Authenticated sessions originating from users whose home organization differs from the organization that owns the SAML provider used in the flow.
New SAML IdP registrations containing signing certificates that are not issued by established corporate certificate authorities.

Detection Strategies

Audit ZITADEL event logs for idp.saml.added and idp.saml.config.changed events correlated with subsequent user.session.added events for accounts outside the creating organization.
Alert when the IdP identifier in a SAML intent callback differs from the IdP previously linked to the authenticating user.
Review administrator activity for creation of SAML providers followed by rapid login attempts targeting privileged accounts.

Monitoring Recommendations

Forward ZITADEL audit events to a central SIEM or data lake and build cross-organization correlation rules on SAML authentication flows.
Monitor for sudden increases in SAML IdP creation events per administrator, which is uncommon in steady-state operations.
Baseline the set of SAML providers per organization and alert on deviations, particularly new providers with self-signed or unknown certificates.

How to Mitigate CVE-2026-109372

Immediate Actions Required

Upgrade ZITADEL to version 4.19.2 or later on the 4.x branch. The 3.x branch is affected through 3.4.15 and should be migrated to a fixed release.
Inventory all SAML identity providers across every organization in the instance and remove any that are not explicitly authorized.
Review audit logs since the earliest affected version was deployed for suspicious SAML IdP creations and cross-organization logins.
Rotate credentials and session tokens for any account where impersonation is suspected.

Patch Information

The maintainers released the fix in ZITADEL 4.19.2. The patched callback enforces that the SAML provider verifying the assertion matches the provider associated with the user resolved from the login intent. Refer to the ZITADEL GitHub Security Advisory GHSA-x4c7-fpcx-w9q6 for release notes and upgrade guidance.

Workarounds

Restrict the IAM_OWNER and organization-administrator roles to a minimal, trusted set of operators until the patch is applied.
Temporarily disable SAML identity provider registration for non-essential organizations where administratively feasible.
Require change-management approval and out-of-band verification for every new SAML IdP configuration until upgrade is complete.

bash

# Verify installed ZITADEL version and plan the upgrade to 4.19.2 or later
zitadel --version

# List configured SAML identity providers for audit (example using the management API)
curl -H "Authorization: Bearer $ZITADEL_PAT" \
  https://<zitadel-host>/management/v1/idps/_search \
  -d '{"queries":[{"idpTypeQuery":{"type":"IDP_TYPE_SAML"}}]}'