ZITADEL’s hosted Login V1 UI allowed an unauthenticated attacker to create a user account bound to an arbitrary external identity provider (IdP) identity without completing authentication at that IdP. By submitting forged identity fields to the “external account not found” registration endpoint, an attacker could pre-create an account for a victim’s public external user ID (for example a GitHub numeric user id). The victim’s later genuine “Sign in with …” then logged into that pre-created account.
An attacker who can reach a Login V1 authentication flow can:
Create a user account without a real IdP login, when the selected IdP allows manual account creation
Bind that account to an attacker-chosen external IdP identity ( IDPConfigID + ExternalUserID )
Pre-hijack a victim’s future first-time external login when the victim’s external user ID is known or guessable
This affects applications that authenticate users through ZITADEL’s hosted Login V1 UI (OIDC/SAML) with at least one external IdP that allows manual account creation.
Scope note: This issue affects Login V1 only. Login V2 uses a cryptographically bound IdP intent and is not affected by this registration path.
Systems running one of the following versions are affected:
4.x: 4.0.0 through 4.16.1 (including RC versions)
3.x: 3.0.0 through 3.4.13 (including RC versions)
The vulnerability has been addressed in the latest releases. Login V1 now requires verified external user data from a completed IdP callback ( authReq.LinkingUsers ) before creating an account, and no longer trusts identity or verification flags from the registration form body alone.
4.x : Upgrade to $\ge$ 4.16.2
3.x : Upgrade to $\ge$ 3.4.14
The recommended solution is to upgrade to a patched version.
If an immediate upgrade is not possible:
Disable Account creation allowed (manually) on each configured external IdP. This blocks the vulnerable registration path, but also disables legitimate self-service account creation via that IdP.
Automatic creation is not affected: it runs only after a verified IdP callback and uses server-side external user data. Automatic creation with manual creation disabled avoids the vulnerable path, but changes onboarding (users are created immediately after IdP login, without the review/edit step). If both manual and automatic creation are enabled, the manual path remains exposed.
If you have any questions or this advisory, please email us at [email protected]
Michael Wollner from Deutsche Telekom AG ( @Ibonok ) for reporting the vulnerability.
Adam Korczynski from Ada Logics ( @AdamKorcz ) for reporting the issue with the help of Anthropic.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
