CVE-2026-109372 | Zitadel up to 3.4.15/4.19.1 SAML Identity-Provider Intent Callback privileges management

October 12, 2026 Yanac

A vulnerability, which was classified as problematic, was found in Zitadel up to 3.4.15/4.19.1. The impacted element is an unknown function of the component SAML Identity-Provider Intent Callback. Executing a manipulation can lead to improper privilege management.

This vulnerability is registered as CVE-2026-109372. It is possible to launch the attack remotely. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More