{"id":"CVE-2026-105208","published":"2026-10-04T15:16:31.843","lastModified":"2026-10-05T16:17:10.920","description":"ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-649"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-jh3m-cr2x-qp88","tags":[]},{"url":"https://www.vulncheck.com/advisories/zitadel-before-4.17.3-session-hijacking-via-forgeable-idp-intent-tokens","tags":[]}],"exploitRefs":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-jh3m-cr2x-qp88","tags":[]}],"hasPoc":true,"ai":{"summary":"ZITADEL's IdP intent tokens are encrypted with unauthenticated encryption that allows users to tamper with their own tokens to impersonate other users during external login flows. This creates a session hijacking vulnerability where attackers can steal tokens or hijack sessions by predicting timing races.","exploitability":"Exploitation requires predicting a victim's in-flight intent identifier and winning a timing race, making it moderately difficult but possible with sufficient reconnaissance and concurrent access to the system.","blast_radius":"The vulnerability could allow attackers to hijack user sessions or steal external identity provider tokens, potentially leading to unauthorized access to multiple applications that rely on ZITADEL for authentication.","remediation":"Upgrade to ZITADEL 3.4.16 or 4.17.3 to address the unauthenticated, malleable encryption issue in IdP intent tokens.","detection":"Monitor for unusual patterns in calls to /v2/idp_intents and /v2/sessions endpoints with unexpected user context changes or token validation failures that occur shortly after legitimate authentication flows.","tags":["auth-bypass","session-hijack","identity-provider","token-malleability"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:52:18.123Z"}}