Session Hijacking Vulnerability in ZITADEL Products by ZITADEL

CVE-2026-105208

What is CVE-2026-105208?

ZITADEL products prior to version 4.17.3 and the 3.x series up to 3.4.15 are exposed to a session hijacking vulnerability stemming from the use of unauthenticated, malleable encryption to protect IdP intent tokens. This flaw allows authenticated users to manipulate their tokens, making them valid for another user's external login request. Attackers who can foresee a victim's in-flight intent identifier could exploit a timing race condition, enabling them to access the /v2/idp_intents or /v2/sessions endpoints. Consequently, this could result in theft of IdP tokens or unauthorized session hijacking.

References