CVE-2026-109374

ZITADEL versions 3.0.0 before 4.19.2 are vulnerable to a privilege escalation flaw within the OIDC token exchange process. The root cause is a failure to properly validate the admin.impersonation check, allowing users with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles to bypass res...

EUVD-2026-97672

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...