CVE ID :CVE-2026-109372 Published : Oct. 12, 2026, 5:17 p.m. | 14 minutes ago Description :ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-109372 - ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

VERWANDTEARTIKEL

CVE-2026-85965 - Use-after-free in Progress MarkLogic Server JavaScript engine integration

CVE-2026-109373 - ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

CVE-2026-109371 - ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

CVE-2026-109357 - LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

CVE-2026-109358 - Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

CVE-2026-109359 - Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery