Summary
A high-severity authentication bypass in ZITADEL's SAML identity-provider callback can allow an organization administrator to obtain an authenticated session as another user. The issue becomes risky when the SAML provider used to verify an assertion can differ from the provider associated with the login intent.
A high-severity authentication bypass in ZITADEL's SAML identity-provider callback can allow an organization administrator to obtain an authenticated session as another user. The issue becomes risky when the SAML provider used to verify an assertion can differ from the provider associated with the login intent.
Affected context
The vulnerability occurs in ZITADEL deployments using SAML identity providers when the intent callback validates an assertion against the provider named in the request URL but resolves the account from a separate login intent without confirming that both providers correspond. Exploitation requires an attacker to have organization-administrator permission and to be able to register or control a SAML provider within the relevant deployment.
The vulnerability occurs in ZITADEL deployments using SAML identity providers when the intent callback validates an assertion against the provider named in the request URL but resolves the account from a separate login intent without confirming that both providers correspond. Exploitation requires an attacker to have organization-administrator permission and to be able to register or control a SAML provider within the relevant deployment.
Exploit preconditions
- Attack surface: The SAML identity-provider intent callback
- Required access: Organization-administrator permission sufficient to register a SAML provider
- Trigger point: Processing a SAML authentication response associated with a login intent
- Required capability: Control of a SAML provider and its signing key
- Why exploitation is possible: The callback verifies the assertion using one provider while resolving the target user from an unrelated provider context
- Attack surface: The SAML identity-provider intent callback
- Required access: Organization-administrator permission sufficient to register a SAML provider
- Trigger point: Processing a SAML authentication response associated with a login intent
- Required capability: Control of a SAML provider and its signing key
- Why exploitation is possible: The callback verifies the assertion using one provider while resolving the target user from an unrelated provider context
Why this happens
The underlying flaw is an authentication-context binding failure. The callback independently trusts the provider identified by the request URL for signature verification and the provider stored in the login intent for user resolution, without enforcing that they are the same security principal. This maps to CWE-287, Improper Authentication, because successful proof from one identity-provider context can be applied to a different user-resolution context.
The underlying flaw is an authentication-context binding failure. The callback independently trusts the provider identified by the request URL for signature verification and the provider stored in the login intent for user resolution, without enforcing that they are the same security principal. This maps to CWE-287, Improper Authentication, because successful proof from one identity-provider context can be applied to a different user-resolution context.
Potential impact
- An attacker may obtain authenticated sessions as users linked to another SAML provider.
- Users in separate organizations could be impersonated where the affected identity-provider relationships exist.
- The attacker could access resources available to the impersonated accounts.
- Administrative, privacy, or data-integrity impacts could result from unauthorized sessions.
- An attacker may obtain authenticated sessions as users linked to another SAML provider.
- Users in separate organizations could be impersonated where the affected identity-provider relationships exist.
- The attacker could access resources available to the impersonated accounts.
- Administrative, privacy, or data-integrity impacts could result from unauthorized sessions.
General mitigation guidance
Mitigation generally focuses on binding every authentication artifact to one
unambiguous identity-provider context.
Common defensive patterns include:
- Requiring the provider used for assertion verification to match the provider associated with the login intent.
- Treating provider identifiers, issuer values, audience values, and login-intent records as a single validated authentication context.
- Rejecting callbacks when provider, issuer, audience, or intent relationships are missing or inconsistent.
- Limiting who can register SAML providers and applying least privilege to organization-administrator roles.
- Isolating organization and provider namespaces so identities cannot be resolved across unintended trust boundaries.
- Logging provider-context mismatches and reviewing existing sessions or provider registrations after suspected exposure.
Mitigation generally focuses on binding every authentication artifact to one
unambiguous identity-provider context.
Common defensive patterns include:
- Requiring the provider used for assertion verification to match the provider associated with the login intent.
- Treating provider identifiers, issuer values, audience values, and login-intent records as a single validated authentication context.
- Rejecting callbacks when provider, issuer, audience, or intent relationships are missing or inconsistent.
- Limiting who can register SAML providers and applying least privilege to organization-administrator roles.
- Isolating organization and provider namespaces so identities cannot be resolved across unintended trust boundaries.
- Logging provider-context mismatches and reviewing existing sessions or provider registrations after suspected exposure.
How teams detect issues like this
Detection approaches can include:
- Static analysis and code review for authentication flows that verify one principal but resolve authorization data from another.
- Review of callback handlers for missing equality checks between request parameters and persisted login-intent attributes.
- Tests that submit valid assertions from one provider while selecting a different provider or login intent.
- Policy checks requiring explicit issuer, audience, provider, and intent binding before session creation.
- Monitoring for newly registered SAML providers, unusual provider changes, and sessions created for unexpected identity-provider relationships.
Detection approaches can include:
- Static analysis and code review for authentication flows that verify one principal but resolve authorization data from another.
- Review of callback handlers for missing equality checks between request parameters and persisted login-intent attributes.
- Tests that submit valid assertions from one provider while selecting a different provider or login intent.
- Policy checks requiring explicit issuer, audience, provider, and intent binding before session creation.
- Monitoring for newly registered SAML providers, unusual provider changes, and sessions created for unexpected identity-provider relationships.
