CyberRota Analysis
AI-GeneratedZITADEL versions 4.x prior to 4.17.3 and 3.x through 3.4.15 are vulnerable due to the use of unauthenticated, malleable encryption for IdP intent tokens, enabling authenticated users to manipulate their tokens for unauthorized access to other users' sessions. This vulnerability allows attackers to potentially steal IdP tokens or hijack sessions by predicting intent identifiers and exploiting timing races. Organizations using affected versions should prioritize patching to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.