ZITADEL lacks enforcement of organization scopes for several authentication pathways, enabling users to authenticate as members of other organizations. This flaw allows an attacker to sign in with credentials that belong to a different tenant, potentially granting unauthorized access to resources protected by that tenancy's policies. The weakness corresponds to missing authentication checks (CWE‑306) and improper authorization of resources (CWE‑863). The impact is the ability to perform unauthorized actions within another organization.

The issue affects ZITADEL open‑source identity management platform, specifically versions prior to 3.4.9 and 4.0.0 up to 4.12.2. Versions 3.4.9 and 4.12.3 contain the fix. Any deployment using the affected releases and relying on organization scope enforcement in authentication is vulnerable.

The CVSS score is 5.3, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation of the login V2, OIDC API V2, and device authorization flows, which all lack the necessary organization scope checks. An attacker who can craft authentication requests that specify organization scopes may obtain tokens for users in other organizations, leading to compromised tenant isolation.