Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN276
_____________________________________________________________________

DATE                : 10/03/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running ZITADEL versions prior
                                      to 4.12.0.

=====================================================================
https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq
_____________________________________________________________________


1-Click Account Takeover via XSS in /saml-post Endpoint
Critical
livio-a published GHSA-pr34-2v5x-6qjq Mar 4, 2026

Package
ZITADEL (ZITADEL)

Affected versions
4.0.0 - 4.11.1

Patched versions
4.12.0


Description

Summary

A vulnerability in Zitadel's login V2 interface was discovered that
allowed a possible account takeover.


Impact

Zitadel exposes an HTTP endpoint named /saml-post. This endpoint is used for
handling requests to SAML IdPs and accepts two HTTP GET parameters: url and
id. When these parameters are supplied, users’ browsers auto-submit an HTTP
POST request to the provided url parameter.

The endpoint insecurely redirects users using the provided url GET parameter.
As a result, by specifying a javascript: scheme, malicious JS code could be
executed on Zitadel users’ browsers.
The endpoint also reflects user-supplied input in the server response,
without HTML-encoding it. As a result, it is possible to inject arbitrary
HTML code, which again leads to malicious JS code execution in the Zitadel
users’ browsers.
An unauthenticated remote attacker can exploit these XSS vulnerabilities,
and thus, execute malicious JavaScript code on behalf of Zitadel users. By
doing so, such an attacker could reset the password of their victims, and
take over their accounts.

It's important to note that this specific attack vector is mitigated for
accounts that have Multi-Factor Authentication (MFA) or Passwordless
authentication enabled.


Affected Versions

Systems running one of the following versions are affected:

    4.x: 4.0.0 through 4.11.1 (including RC versions)

Important Note: Although this /saml-post endpoint is used when Zitadel is
integrated with a SAML Identity Provider (IdP), the vulnerability in this
finding does not require Zitadel to be configured with a SAML IdP.
Consequently, Zitadel is vulnerable in its default, out-of-the-box
configuration.


Patches

The vulnerability has been addressed in the latest releases. The patch
reworked the integration of SAML IdPs and the /saml-post endpoint no longer
exists. Additionally, the page to change the password, now always requires
the user's current password regardless of the state of the authenticated
session.

4.x: Upgrade to >=4.12.0


Workarounds

The recommended solution is to upgrade to a patched version. If an upgrade
is not possible and no SAML IdP integration is needed, a WAF or reverse
proxy rule can be deployed to prevent access to the endpoint.


Questions

If you have any questions or comments about this advisory, please email us
at security@zitadel.com


Credits

Thanks once again to Amit Laish from GE Vernova for finding and reporting the
vulnerability.


Severity
Critical
9.3/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE ID
CVE-2026-29191

Weaknesses
No CWEs

Credits

    @amit-laish amit-laish Reporter
    @bastionstack bastionstack Remediation developer
    @livio-a livio-a Other


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================