A vulnerability in Zitadel allows attackers with impersonator roles to perform OIDC token exchange that bypasses the admin.impersonation check, effectively enabling them to log in as administrators with full claims and roles. This privilege escalation can grant unauthorized access to privileged functions and data. The flaw is an authenticated privilege escalation due to missing authorization checks (CWE‑863).

In versions 3.0.0 through 4.19.1 of Zitadel, the token exchange component lacks proper admin impersonation validation. All deployments of Zitadel within this version range are affected. Administrators should review deployed instances for these versions.

The CVSS score of 5.1 reflects moderate severity, and the vulnerability is not currently listed in CISA KEV or predicted with a high EPSS score. An attacker only needs to possess IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles; with those, they can exploit the vulnerability over the network by sending a crafted OIDC token exchange request. While exploitation requires existing impersonator permissions, the resulting elevation is to administrator level, making it a significant risk to confidentiality and integrity.