CVE-2026-109372: ZITADEL SAML identity-provider authentication bypass

CVE-2026-109372 · Severity: high · CVSS 8.7 · Published 2026-10-12

ZITADEL is an identity and access management platform that uses SAML to authenticate users across multiple identity providers. An attacker with organization-administrator privileges can register their own SAML provider and use it to impersonate any user linked to a different SAML provider on the same instance, gaining full access to that user's authenticated sessions across all connected applications without the victim's knowledge or interaction.

Quick answers

Is CVE-2026-109372 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109372 being exploited in the wild.
How severe is CVE-2026-109372?
High severity, with a CVSS score of 8.7, published 12 October 2026.
Which products and versions are affected?
ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.19.1.
Is there a fix for CVE-2026-109372?
Yes: fixed in ZITADEL 4.19.2 and later; 3.x line reached end-of-life and will not receive fixes. Until then: On self-hosted deployments, disable public organization registration (DisallowPublicOrgRegistration setting) to prevent unauthenticated attackers from gaining organization-administrator permission; however, this does not mitigate the risk from existing administrators. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109372 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-109372?
Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: ZITADEL 4.19.2 and later; 3.x line reached end-of-life and will not receive fixes

On self-hosted deployments, disable public organization registration (DisallowPublicOrgRegistration setting) to prevent unauthenticated attackers from gaining organization-administrator permission; however, this does not mitigate the risk from existing administrators.

Technical details

The SAML identity-provider intent callback fails to verify that the identity provider validating the assertion signature matches the identity provider for which the login intent was created. An attacker with org.idp.write permission can register a SAML provider with a signing key they control, then submit a crafted SAML assertion to a login intent meant for a different provider; the callback accepts the signature verification from the attacker's provider but resolves the user account from the original intent, bypassing authentication checks.

Affected products

  • ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.19.1

Timeline

  • 2026-09-28: disclosed
  • 2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.