ZITADEL CVE-2026-109372

Requires the attacker to already hold organization-administrator permission on the target ZITADEL instance (PR:H) and the ability to register a new SAML identity provider with a signing key of their choosing. A viable target user must be linked to a different, legitimate SAML provider on the same instance - the bypass works because the intent callback verifies the assertion signature against the provider named in the request URL but resolves the user from the login intent without confirming the two match. Exploitation is limited by the org-admin prerequisite and by the requirement that victims authenticate via SAML identity providers; instances that do not use SAML federation or that tightly restrict org-admin assignment are not realistically exposed. No special network positioning or user interaction is needed (AV:N/UI:N).

This is a genuine high-priority vulnerability, though not a 'spray-and-pray' internet-wide threat. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N, score 9.3) tells a consistent story with the description: network-reachable, low attack complexity, no user interaction, but requiring high privileges (PR:H) - the attacker must already hold organization-administrator permission on the ZITADEL instance. The high-privilege requirement is the single most important mitigating signal and explains why this is a privilege-escalation/account-takeover flaw rather than an unauthenticated breach. Where it becomes severe is the scope change (SC:H/SI:H) and VC:H/VI:H: a compromised or malicious org-admin in one tenant can mint sessions as any user linked to another SAML provider on the instance, INCLUDING users in other organizations, which breaks the core tenant-isolation guarantee of a multi-tenant IAM product. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified; absence of a POC does not imply difficulty given AC:L. The CVSS vector and the prose description agree (both point to authenticated/network with a trust-boundary cross), so there is no internal conflict to flag - but defenders should note the risk is concentrated in environments that delegate org-admin to semi-trusted or numerous parties.

An attacker who holds organization-administrator rights in one tenant of a shared ZITADEL instance registers a SAML identity provider configured with their own signing key. They then drive the SAML intent callback so the assertion is validated against their attacker-controlled provider while the login intent resolves to a victim user bound to a different, legitimate SAML provider - yielding an authenticated session as that victim, potentially in another organization. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction make exploitation straightforward for anyone meeting the org-admin prerequisite.