PT-2026-26195 · Zitadel · Zitadel
Motoki317
·
Published
2026-03-18
·
Updated
2026-03-27
·
CVE-2026-33132
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ZITADEL versions prior to 3.4.9
ZITADEL versions 4.0.0 through 4.12.2
Description
ZITADEL, an open source identity management platform, had a flaw where organization enforcement during authentication could be bypassed. The platform uses scopes (
urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}) to enforce an organization context during authentication. This enforcement was properly implemented for OAuth2/OIDC authorization requests in login V1, but was missing for device authorization requests and all login V2 and OIDC API V2 endpoints. This allowed users to sign in with accounts from other organizations. The issue did not affect applications relying on authorizations or role assignments. The vulnerability was addressed by validating provided scopes and enforcing organization existence when processing authorization requests, and by preventing the use of sessions from users not belonging to the required organization on the OIDC service endpoints, specifically the CreateCallback and AuthorizeOrDenyDeviceAuthorization API Endpoints.Recommendations
Versions prior to 3.4.9: Update to version 3.4.9 or later.
Versions 4.0.0 through 4.12.2: Update to version 4.12.3 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zitadel