Listen to this Post
How the CVE Works
The vulnerability is in ZITADEL’s user federation auto-linking logic. When a user logs in via an external Identity Provider (IdP), the system can automatically link that external identity to an existing internal account if email addresses match. The flaw occurs because the authentication flow did not verify the organization’s active security policy before performing this auto-linking. Even if an Organization Administrator explicitly deactivated a specific IdP or disabled federation entirely for their organization, the auto-linking process would ignore these settings. An attacker could thus initiate a login through an officially disabled IdP. ZITADEL would accept the external assertion, match the attacker’s identity (e.g., email) to a valid internal user, and link the accounts, granting the attacker access. This bypasses organizational security mandates, leading to account takeover, unless the target account had MFA enabled.
Platform: ZITADEL
Version: 2.50.0 to <2.71.19, <3.4.4, <4.6.6
Vulnerability : Authentication Bypass
Severity: Critical
date: 2025-11-13
Prediction: 2025-11-20
What Undercode Say:
curl -v 'https://targetzitadel.instance/oidc/v1/authorize?response_type=code&client_id=...&scope=openid...&redirect_uri=...'
Attempt OIDC flow through a known but potentially disabled IdP.
cat > malicious_jwt.json << 'EOF'
{"iss":"disabled_idp","sub":"attacker_id","email":"[email protected]"}
EOF
Crafting a simulated IdP response matching a victim's email.
How Exploit:
An attacker identifies a victim’s email and a disabled instance-level IdP. They initiate a login to the ZITADEL organization using that IdP. The platform processes the request, bypasses the disabled IdP check during auto-linking, matches the attacker-provided email to the victim’s internal account, and links them. The attacker gains access to the victim’s account.
Protection from this CVE
Upgrade to versions 4.6.6, 3.4.4, or 2.71.19. Ensure all IdP configurations are reviewed. Enforce MFA for all privileged accounts.
Impact:
Full account takeover for accounts without MFA. Bypass of organization-level authentication policies. Compromise of administrative and user accounts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
