GHSA-3gwf-ph53-v73c

ZITADEL issued tokens or a SAML response for an OIDC or SAML authorization request without ensuring that the session used to complete the request had been authenticated to the request’s requirements by an authorized login client. Completing a request is meant to be performed only by a login client holding the session.link permission, which is responsible for verifying the session first. That guarantee was not enforced, and the gap was reachable through ZITADEL’s hosted Login V2 and directly through the completion endpoints.

Through the hosted Login V2, a request could be completed with a session on which no authentication factor had been verified: an unauthenticated attacker who knows a victim’s login name could obtain tokens or a SAML response for that user when the user has two or more linked identity providers, or when the organization disables local authentication and offers two or more identity providers — both possible under the default login policy.