GHSA-3985-45jm-558m

ZITADEL’s hosted Login V1 UI allowed an attacker who can sign in to an instance with their own account, and who knows a victim’s login name, to obtain OIDC tokens for the victim without the victim’s credentials.

Authorization codes issued at the end of a Login V1 sign-in were not reliably bound to the user who completed that sign-in, so the token endpoint could issue tokens for a user who had not authenticated.

An attacker who can complete a Login V1 sign-in with their own account and knows a victim’s login name can:

• Sign in to an OIDC application as the victim — the application receives an ID token, an access token, a refresh token if requested, and userinfo for the victim.
• Bypass all of the victim’s authentication — none of the victim’s factors (password, passkeys, TOTP, OTP-SMS, OTP-Email, U2F) or external identity provider sign-ins are checked.
• Act with the victim’s roles and grants in that application.