CVE-2026-109372 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL deployments, particularly those using SAML authentication, should assess exposure and prioritize verification and remediation efforts. This includes reviewing SAML provider configurations for potential security risks, upgrading to ZITADEL version 4.19.2 or later, and monitoring for suspicious activity related to SAML authentication. Additionally, security teams should conduct a thorough risk assessment to identifypotential

Why it matters

Defenders should prioritize verifying and upgrading to ZITADEL version 4.19.2 or later, and review SAML provider configurations for potential security risks, as the authentication bypass vulnerability can lead to account takeover and bypass of authentication mechanisms.

• Potential account takeover for users linked to SAML providers
• Bypass of authentication mechanisms
• Possible lateral movement within organizations

Technical summary

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations. This vulnerability can lead to account takeover and bypass of authentication mechanisms, emphasizing the need for defenders to prioritize verifying and upgrading to ZITADEL version 4.19.2 or later.

Defensive priority

Defenders should prioritize verifying and upgrading to ZITADEL version 4.19.2 or later, and review SAML provider configurations for potential security risks.

Recommended defensive actions

• Verify and upgrade to ZITADEL version 4.19.2 or later
• Review SAML provider configurations for potential security risks
• Monitor for suspicious activity related to SAML authentication
• Perform vulnerability scanning to identify potentially affected systems
• Implement additional logging and monitoring for SAML authentication events
• Review access controls and permissions for SAML providers
• Conduct a thorough risk assessment to identify potential impacts on the organization

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in ZITADEL's SAML identity-provider intent callback. However, the corpus does not provide information on known exploitation or affected organizations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.