Advisory · CVE-2026-105208
Forgeable ZITADEL IdP intent tokens allow session hijacking
ZITADEL encrypts IdP intent tokens without authentication, letting attackers tamper with their own token so it is accepted for another user's external login intent and steal IdP tokens or sessions.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105208
CWE-649 - Action timing
- Immediate
Explain it like I’m five
ZITADEL seals the envelope for outside-login requests with wax but no signature, so anyone can reseal it with different contents. An attacker reshapes their own envelope to point at a victim's in-flight login, then collects the victim's login tokens or walks into their session.
- 01Attacker obtains token
An authenticated attacker receives their own IdP intent token, protected only by unauthenticated, malleable encryption.
- 02Token tampered
The attacker modifies the token so it is accepted for another user's external login intent.
- 03Race for victim's intent
The attacker predicts a victim's in-flight intent identifier and wins a timing race.
- 04Tokens or session stolen
Calls to /v2/idp_intents or /v2/sessions hand the attacker the victim's IdP tokens or an active session.
What happened
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, so authenticated users can tamper with their own token until it is accepted for another user’s external login intent. An attacker who predicts a victim’s in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim’s IdP tokens or hijack their session. It is rated high at CVSS 8.7 under CVSS v4.0 (7.7 under v3.1) and tracked as CWE-649.
What to do
- Upgrade ZITADEL to 4.17.3 or later (the 3.x line is affected through 3.4.15).
- Review session and IdP-intent logs for intent identifiers reused across users or sessions created from mismatched intents.
- Consider invalidating active sessions and refresh tokens issued during the exposure window if tampering cannot be ruled out.
- Monitor for follow-on abuse of any stolen IdP tokens in connected services.
Management note
Encryption without integrity is a classic failure mode, and in an identity provider it turns into session theft. The attack needs an authenticated starting point and a timing race, which narrows the attacker pool, but on a busy login deployment the race is winnable. Upgrade, then decide whether the session inventory needs a reset.