CVE-2026-105208

high

Description

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.

References

https://www.vulncheck.com/advisories/zitadel-before-4.17.3-session-hijacking-via-forgeable-idp-intent-tokens

https://github.com/zitadel/zitadel/security/advisories/GHSA-jh3m-cr2x-qp88

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92101

Details

Source: Mitre, NVD

Published: 2026-10-04

Updated: 2026-10-29

Risk Information

CVSS v2

Base Score: 6.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 7.7

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Severity: High

EPSS

EPSS: 0.00081