ZITADEL auto-linking flaw exposes accounts under specific configurations

The GitHub Security Advisory database reports a medium-severity vulnerability in ZITADEL versions 3.0.0 through 3.4.12 and 4.0.0 through 4.15.2, including RC versions. The issue arises when administrators enable auto-linking by email for external identity providers (IdPs). While ZITADEL verifies the local user's email, it does not check whether the external IdP has verified the email upstream. This creates a risk if the external provider allows unverified email signups, as attackers could register with a victim's email and gain unauthorized access to the victim's local account.

Operators should review their configurations for external identity providers, particularly those that permit unverified email registrations. Before upgrading, ensure that any permissive IdPs are either disabled or carefully vetted to mitigate risks. This advisory highlights the importance of cross-verifying upstream identity assertions, a pattern increasingly emphasized in identity federation security practices.