Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints. This allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 2 | Disclosure2 |
| 2026-03-22 | 1 | Disclosure1 |
CVE-2026-33132 ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authe… https://www.cve.org/CVERecord?id=CVE-2026-33132
Post summary
The post discloses that ZITADEL versions before 3.4.9 and from 4.0.0 to 4.12.2 permit bypassing organization enforcement during authentication.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33132 - ZITADEL is missing enforcement of organization scopes Intel Report: https://ift.tt/o68rpWv
Post summary
A new vulnerability (CVE‑2026‑33132) affecting ZITADEL has been disclosed, highlighting a flaw where organization scope enforcement is missing.
CVE-2026-33132 Authentication Bypass in ZITADEL Identity Management Plat... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33132 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE‑2026‑33132, an authentication bypass in ZITADEL, and provides a link to details, but does not offer additional technical, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zitadel | zitadel | - | - | - |