CVE-2026-105208

Summary

ZITADEL's IdP intent tokens are encrypted with unauthenticated encryption that allows users to tamper with their own tokens to impersonate other users during external login flows. This creates a session hijacking vulnerability where attackers can steal tokens or hijack sessions by predicting timing races.

Exploitability

Exploitation requires predicting a victim's in-flight intent identifier and winning a timing race, making it moderately difficult but possible with sufficient reconnaissance and concurrent access to the system.

Blast radius

The vulnerability could allow attackers to hijack user sessions or steal external identity provider tokens, potentially leading to unauthorized access to multiple applications that rely on ZITADEL for authentication.

Detection

Monitor for unusual patterns in calls to /v2/idp_intents and /v2/sessions endpoints with unexpected user context changes or token validation failures that occur shortly after legitimate authentication flows.

Prioritized remediation

Upgrade to ZITADEL 3.4.16 or 4.17.3 to address the unauthenticated, malleable encryption issue in IdP intent tokens.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.