GHSA-j4g7-v4m4-77px
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
github.com/zitadel/zitadel🐹github.com/zitadel/zitadel🐹github.com/zitadel/zitadel🐹github.com/zitadel/zitadelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.
Impact
This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.
This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.
This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.
Affected Versions
Systems running one of the following versions are affected:
- v4.x:
4.0.0-rc.1through4.6.5 - v3.x:
3.0.0-rc.1through3.4.3 - v2.x:
2.50.0through2.71.18
Patches
The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.
- v4.x: Upgrade to version 4.6.6 or later.
- v3.x: Update to version 3.4.4 or later.
- v2.x: Update to version 2.71.19 or later.
Workarounds
Upgrading to a patched version is the recommended solution.
Questions
If you have any questions or comments about this advisory, please email Zitadel at [email protected]
Credits
Thanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/zitadel/zitadel | ≥ 4.0.0-rc.1&&< 4.6.6 | 4.6.6 |
| 🐹Go | github.com/zitadel/zitadel | ≥ 3.0.0-rc.1&&< 3.4.4 | 3.4.4 |
| 🐹Go | github.com/zitadel/zitadel | ≥ 2.50.0&&< 2.71.19 | 2.71.19 |
| 🐹Go | github.com/zitadel/zitadel | ≥ 1.80.0-v2.20.0.20240403060621-5b3946b67ef6&&< 1.80.0-v2.20.0.20251112124840-33c51deb2040 | 1.80.0-v2.20.0.20251112124840-33c51deb2040 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zitadel/zitadel. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/zitadel/zitadel to 4.6.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j4g7-v4m4-77px is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-j4g7-v4m4-77px is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-j4g7-v4m4-77px. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-j4g7-v4m4-77px in your dependencies?
O3 detects GHSA-j4g7-v4m4-77px across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.