Servers and applications
GHSA-gx82-3gqq-j4h5
Session API and Login V2: organization login policy not enforced for password sign-in
- Severity
- High 7.1
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 4.20.3
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data · Change some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N- Sources
- Project advisories (GitHub)
Description
ZITADEL allowed anyone who knows the password of a user to sign in with it through Login V2 and the Session API, even when the user’s organization has disabled local authentication (username and password) and requires sign-in through an external identity provider.
Login V2 checked this setting at the login name step. Its password step, however, did not reliably check it against the user’s own organization. The Session API (CreateSession and SetSession, v2 and v2beta) accepted password checks without reading the login policy. In both vectors, a password sign-in was never checked against the login policy of the user’s own organization.
An attacker who knows the password of a user in an organization with local authentication disabled can:
- Sign in with username and password through Login V2 and get a valid session for every application that uses ZITADEL for sign-in.
Workarounds
The recommended solution is to upgrade to a patched version. There is no configuration that fully closes this gap on unpatched versions.
Affected software
| Software | Affected versions |
|---|---|
ZITADELServers and applications · github:zitadel/zitadel |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-gx82-3gqq-j4h5
- github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-gx82-3gqq-j4h5