-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allowed an attacker to link their external identity to an existing ZITADEL account, even if the Identity Provider (IdP) used was disabled for the target organization. This was due to a missing validation step in the user linking process. The analysis of the patch commit 33c51deb20402dd5720e32cfb0c1d5fdc752f2e0 reveals the exact locations of this missing check in both the Go backend and the TypeScript login application.
In the Go backend (internal/api/ui/login/external_provider_handler.go), the Login.autoLinkUser function was directly responsible for linking the user without checking permissions. The patch introduces a call to a new function, checkAutoLinkingAllowedForUserAndIdP, which verifies the organization's login policy and checks if the IdP is active and allowed. The calling function, Login.checkAutoLinking, was also flawed as it incorrectly assumed a successful link.
Similarly, in the TypeScript login application (apps/login/src/lib/server/idp-intent.ts), the processIDPCallback function, which handles the post-authentication flow, lacked the necessary checks. It would find a user and proceed to link them via addIDPLink without validating the IdP against the organization's policies. The patch rectifies this by adding a call to the new validateIDPLinkingPermissions function before attempting to link the user.
Therefore, during an exploit, a profiler would show Login.autoLinkUser and Login.checkAutoLinking in the stack trace for the Go backend, and processIDPCallback for the Node.js-based login application, as these are the functions that improperly handled the user linking process.
Login.autoLinkUserinternal/api/ui/login/external_provider_handler.go
Login.checkAutoLinkinginternal/api/ui/login/external_provider_handler.go
processIDPCallbackapps/login/src/lib/server/idp-intent.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | >= 4.0.0-rc.1, < 4.6.6 | 4.6.6 |
| github.com/zitadel/zitadel | go | >= 3.0.0-rc.1, < 3.4.4 | 3.4.4 |
| github.com/zitadel/zitadel | go | >= 2.50.0, < 2.71.19 | 2.71.19 |
| github.com/zitadel/zitadel | go | >= 1.80.0-v2.20.0.20240403060621-5b3946b67ef6, < 1.80.0-v2.20.0.20251112124840-33c51deb2040 | 1.80.0-v2.20.0.20251112124840-33c51deb2040 |
Ongoing coverage of React2Shell