Executive brief
ZITADEL is an identity and access management (IAM) platform that supports federated login through external identity providers. When administrators enable automatic account linking by email, ZITADEL fails to verify that the external provider actually confirmed email ownership. An attacker can exploit this by signing up on a permissive external provider with a victim's email address, then logging in to automatically hijack the victim's ZITADEL account without their knowledge or consent.
Technical details
This is an improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler. When auto-linking by email is enabled, the system checks that the local user's email is verified but does not cross-check whether the external IdP also verified that email upstream. An attacker can register on a loosely-configured external provider (one allowing unverified email signup) using a victim's email address. Upon federated login, ZITADEL automatically links the attacker's federated identity to any existing local account with a matching email, granting full account access. The attack requires no user interaction and network-reachable endpoints. The vulnerability affects versions 4.0.0–4.15.2 and 3.0.0–3.4.12; patches are available in 4.15.3 and later. The practical risk is configuration-dependent, requiring an administrator to have explicitly enabled email auto-linking with a permissive external provider.
Affected products
- ZITADEL ZITADEL 4.0.0 through 4.15.2; 3.0.0 through 3.4.12
Timeline
- 2026-06-22: disclosed
- 2026-09-11: advisory
- 2026-09-11: patched: Patched in version 4.15.3
References
- https://api.github.com/users/Android-Login-Analysis
- https://github.com/Android-Login-Analysis
- https://api.github.com/users/Android-Login-Analysis/gists%7B/gist_id%7D
- https://api.github.com/users/Android-Login-Analysis/repos
- https://avatars.githubusercontent.com/u/43461385?v=4
- https://api.github.com/users/Android-Login-Analysis/events%7B/privacy%7D