Critical · published November 13, 2025
⚡ An unchecked federation process in ZITADEL lets attackers auto-link their accounts to unsuspecting users — it's like letting a stranger into a secured party! 🎉 Think of ZITADEL as a nightclub with a strict guest list. This vulnerability is akin to a bouncer who forgets to check IDs, allowing anyone to waltz in and claim to be someone else — a total security breach! An attacker could completely takeover a legitimate user’s account by exploiting this flaw, potentially accessing sensitive data and resources. If they can slip past the security checks, they might as well be the life of the party — and that could be absolutely devastating for your organization!
Think of ZITADEL as a nightclub with a strict guest list. This vulnerability is akin to a bouncer who forgets to check IDs, allowing anyone to waltz in and claim to be someone else — a total security breach! This vulnerability arises from ZITADEL's failure to enforce an organization's security policies during the authentication process, allowing unauthorized users to link to existing accounts without proper validation.
An attacker could completely takeover a legitimate user’s account by exploiting this flaw, potentially accessing sensitive data and resources. If they can slip past the security checks, they might as well be the life of the party — and that could be absolutely devastating for your organization! Upgrade to ZITADEL versions 4.6.6, 3.4.4, or 2.71.19 immediately to fix this vulnerability. Regularly audit your identity provider settings to ensure they align with your security policies. 🚨 You can tackle this! By patching up and staying vigilant, you’ll keep your organization secure and avoid unwelcome guests! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zitadel/zitadel | ≥ 2.50.0, < 2.71.19 | 2.71.19 |
| zitadel/zitadel | ≥ 3.0.0, < 3.4.4 | 3.4.4 |
| zitadel/zitadel | ≥ 4.0.0, < 4.6.6 | 4.6.6 |