CVE-2026-109374 in Zitadel
Summary
by MITRE • 10/12/2026
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within ZITADEL versions prior to 4.19.2 represents a critical privilege escalation flaw rooted in the OpenID Connect token exchange mechanism. This security defect allows authenticated users possessing specific impersonation roles, namely IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR, to bypass administrative access controls and assume the identity of high-privilege accounts such as administrators with the IAM_OWNER role. The core technical failure lies in the improper validation logic during the token exchange process, where the system fails to adequately restrict which target roles can be impersonated based on the scope or claims presented by the requesting client application. Consequently, an attacker who has been granted limited impersonation privileges can exploit this oversight to generate valid authentication tokens that carry administrative permissions, effectively elevating their access level from a standard end-user context to one of full system administration without requiring additional credentials or exploiting separate injection flaws.
From a technical perspective, the flaw stems from insufficient authorization checks within the OIDC provider's token endpoint implementation. When an application requests a token on behalf of another user through impersonation flows, the server must verify that the requesting role has explicit permission to assume the target identity and associated privileges. In this instance, the validation logic for the admin.impersonation check is either missing or incorrectly implemented, allowing tokens signed with administrative claims to be issued even when the source principal lacks the requisite authority to hold those specific roles. This misconfiguration enables end-user impersonators to sign in to relying applications as administrators, inheriting their full set of rights and claims. The attack vector relies on social engineering or prior compromise of a low-privilege account with impersonation capabilities, followed by interaction with vulnerable client applications that accept these forged administrative tokens without further verification.
The operational impact of this vulnerability is severe due to the complete bypass of identity and access management controls. An adversary gaining IAM_OWNER level privileges can perform any action available to system administrators, including modifying user accounts, altering security policies, accessing sensitive data repositories, and potentially compromising the entire infrastructure managed by ZITADEL. This undermines the fundamental principle of least privilege and compromises the integrity of multi-tenant environments where strict separation between administrative and end-user functions is critical for compliance with standards such as SOC 2 or ISO 27001. The ability to impersonate administrators also facilitates persistent access, as attackers can create backdoor accounts or modify existing configurations to maintain footholds even after initial detection attempts.
This vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization in the Common Weakness Enumeration framework. In terms of offensive security tactics, it corresponds to ATT&CK technique T1078 Valid Accounts, specifically involving legitimate accounts being used for unauthorized administrative access through privilege escalation mechanisms. The exploitation path reflects common patterns seen in identity-centric attacks where trust relationships between services are abused to expand lateral movement capabilities within an enterprise network.
To mitigate this risk, organizations running ZITADEL versions before 4.19.2 must upgrade immediately to the patched version that corrects the token exchange validation logic. Administrators should also audit existing role assignments to ensure that IAM_END_USER_IMPERSONATOR and ORG_END_USER_IMPERSONATOR roles are granted only to trusted applications or users with a strict need-to-know basis. Implementing additional monitoring for unusual administrative login patterns, particularly those originating from non-administrative source accounts, can help detect potential exploitation attempts in real-time. Furthermore, enforcing multi-factor authentication for all administrative actions and reviewing relying application configurations to ensure they validate token scopes appropriately will reduce the attack surface associated with this identity management flaw.