External risk intelligence

ZITADEL SAML Authentication Bypass Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109372

ZITADEL is an identity management and authentication platform designed to be exposed to the internet to handle user logins and federated identity services like SAML. Because it functions as an identity provider and gateway for authentication, its endpoints are public-facing by design to support external application integrations and user access.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security flaw in ZITADEL, an identity and access management system. The vulnerability could allow an attacker with administrative privileges to bypass authentication and impersonate any user within the system, including those in other organizations. This is a serious concern as it could lead to unauthorized access to sensitive data and systems.

Authentication bypass through SAML confusion.
Impacts user trust and system integrity.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

Attackers with organization administrator privileges can exploit this vulnerability by configuring a rogue SAML identity provider. This allows them to impersonate any user on the ZITADEL instance, potentially affecting multiple organizations.

Requires organization administrator permission.
Bypass SAML assertion signature verification.
Leads to account takeover and data access.

Live Threat

Current exploitation, exposure, and threat context

Attackers with organization-administrator privileges could exploit this vulnerability to bypass authentication and gain unauthorized access to any user's account within the ZITADEL instance, potentially affecting multiple organizations. This occurs when an attacker registers a SAML provider with their own signing key, and the system misdirects the login intent.

User session data at risk.
SAML assertion signature bypass.
Unauthorized user access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ZITADEL's SAML identity provider processing requires immediate attention from teams managing authentication and identity services. The first practical step is to inventory all ZITADEL instances, confirm their exposure and criticality, and identify the specific application or platform owners responsible for their maintenance. Subsequent remediation planning should prioritize the highest-risk deployments, potentially involving vendor coordination or temporary risk reduction measures until a full fix can be applied during a planned maintenance window.

Identify ZITADEL instances and responsible owners.
Verify SAML configurations and potential exposure.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ZITADEL?

ZITADEL is an open-source identity and access management platform. It functions as an identity provider, allowing organizations to manage user logins, handle authentication, and integrate federated identity services like SAML across various applications.

What does CVE-2026-109372 mean?

This vulnerability is an authentication bypass, classified under CWE-287 (Improper Authentication). It occurs due to a logic flaw in how ZITADEL handles SAML identity-provider callbacks. Specifically, the system validates the SAML signature correctly but fails to ensure the user identified in the login intent actually corresponds to the specific provider being used, allowing for session impersonation.

How can an attacker trigger this bug?

The attack requires someone to already hold organization-administrator permissions within ZITADEL. By registering a malicious SAML identity provider using their own signing key, the administrator can trick the system into resolving a user session for any account linked to a different, legitimate SAML provider. Simply being a standard user or an unauthenticated visitor does not trigger this issue.

Why is this relevant to my infrastructure?

According to Halo Surface Signal, ZITADEL is designed to be internet-facing to support user logins and external integrations. Because it sits at the gateway of your authentication architecture, any instance exposed to the network is potentially reachable, making it critical to determine if your deployment is accessible from the internet.

What should I do to secure my ZITADEL instance?

Begin by auditing your ZITADEL installations to identify which ones are active and who is responsible for their maintenance. Verify your current version against the advisory, review SAML identity provider configurations for suspicious entries, and coordinate with your team to schedule an update to the patched software versions as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.