Authentication Bypass Vulnerability in ZITADEL Identity Management Platform
CVE-2026-33132
What is CVE-2026-33132?
ZITADEL, an open source identity management platform, has a vulnerability that allows unauthorized users to bypass organization enforcement during authentication. This flaw affects versions prior to 3.4.9 and 4.0.0 through 4.12.2 and primarily impacts device authorization requests and certain login endpoints, which lacked adequate enforcement measures for organization context during sign-in. As a result, users could log in using credentials from different organizations without proper authorization checks. The vulnerability has been addressed in the patched versions 3.4.9 and 4.12.3.
Affected Version(s)
zitadel >= 4.0.0-rc.1, < 4.12.3 < 4.0.0-rc.1, 4.12.3
zitadel >= 3.0.0-rc.1, < 3.4.9 < 3.0.0-rc.1, 3.4.9
zitadel < 1.80.0-v2.20.0.20260317120401-d90285929ca0 < 1.80.0-v2.20.0.20260317120401-d90285929ca0