GHSA-fphg-99ff-7qrp

ZITADEL’s hosted Login V2 UI did not bind an external identity‑provider (IdP) sign‑in to the browser that started it. An attacker could get a victim’s browser to finish an external IdP sign‑in that the attacker had started with their own account, so that the victim ended up signed in to the attacker’s ZITADEL account. This is commonly called login CSRF, session swapping, or account pre‑hijacking.

The sign‑in was completed without verifying that the browser finishing it was the same browser that started it.

An attacker who can sign in to the instance with their own external IdP identity can:

• Place a victim into the attacker’s account when the victim opens a link from the attacker, with no further interaction.
• Collect what the victim then does under that identity: data the victim enters, documents they upload, and integrations or authentication methods they configure all land in the attacker‑controlled account and can be retrieved by the attacker later.