ZITADEL possesses an authentication bypass (CWE-287) in the SAML identity‑provider intent callback. The system verifies the assertion signature against the provider specified in the request URL but resolves the user from the login intent without ensuring the two match. Attackers who possess organization‑administrator privileges can register a new SAML provider using their own signing key. By doing so, they can obtain authenticated sessions as any user that is linked to an existing SAML provider on the same instance, including users in other organizations. The result is that the attacker can take over any user account present in the system without needing the correct credentials.

The vulnerability affects ZITADEL releases 4.x prior to version 4.19.2 and 3.x through 3.4.15. Any instance running these versions and configured with SAML identity providers is at risk. The threat requires the attacker to have organization‑administrator rights within the target organization.

The CVSS score of 9.3 indicates a critical level of severity. Although no EPSS score is publicly available, the high CVSS rating and the fact that the exploit requires only rights to register a SAML provider suggest that it could be widely actionable by attackers who have gained a foothold within the organization. The vulnerability is not listed in CISA’s KEV catalog, but it remains a significant risk, especially in multi‑tenant deployments where a compromised administrator can target users across organizational boundaries.