-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allowed the reuse of IdP intent tokens. This was possible because the mechanisms for processing these tokens during session authentication (SetSession, CreateSession) did not adequately check if a token had already been consumed or if it had expired. Additionally, the endpoint for retrieving intent details (RetrieveIdentityProviderIntent) did not check for token expiry. The patch addressed these issues by:
maxIdPIntentLifetime) and checking this expiry in internal/command/session.go (within the logic called by SetSession/CreateSession) and directly in RetrieveIdentityProviderIntent.domain.IDPIntentStateConsumed and idpintent.ConsumedEvent), ensuring that an intent token, once used, cannot be used again. This check is implicitly part of the cmd.intentWriteModel.State != domain.IDPIntentStateSucceeded check after the model reduction in internal/command/session.go.
The identified vulnerable functions are the gRPC API endpoints that an attacker would interact with to exploit this flaw. While the core logic changes are in the internal/command layer, these gRPC methods were the entry points that exposed the vulnerability.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | >= 3.0.0-rc.1, <= 3.0.0-rc.3 | 3.0.0 |
| github.com/zitadel/zitadel | go | < 2.70.10 | 2.70.10 |
| github.com/zitadel/zitadel |
| go |
| >= 2.71.0, <= 2.71.8 |
| 2.71.9 |
Ongoing coverage of React2Shell