CVE-2026-32130: 
NixOS vulnerability analysis and mitigation

CVE-2026-32130 is an authentication bypass vulnerability in ZITADEL's SCIM (System for Cross-domain Identity Management) API, allowing unauthenticated attackers to retrieve sensitive user information by exploiting URL-encoded path values. It affects ZITADEL versions 2.68.0 through 2.71.19, 3.0.0 through 3.4.7, and 4.0.0 through 4.12.1. The vulnerability was disclosed on March 11, 2026, and patched in the same-day releases of versions 3.4.8 and 4.12.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an authentication bypass via an alternate path or channel (CWE-288), where ZITADEL's authentication middleware failed to correctly resolve URL-encoded path segments before performing authentication and permission checks. When a request to the SCIM API included URL-encoded path values (e.g., %2F instead of /), the router correctly matched and dispatched the request, but the auth middleware did not decode the path before evaluating access controls, effectively skipping them. The fix, applied in commits d873a7e (v3.4.8) and fdf676e (v4.12.2), corrects the handling of encoded paths in the auth middleware (GitHub Advisory, v3.4.8 Release, v4.12.2 Release).

Successful exploitation allows unauthenticated remote attackers to read sensitive personally identifiable information (PII) from the SCIM API, including user names, email addresses, phone numbers, physical addresses, external IDs, and role assignments. Because ZITADEL is an identity management platform, exposure of this data could facilitate targeted phishing, account enumeration, or privilege escalation in downstream systems. Data modification and deletion are not possible through this vulnerability due to additional server-side checks on write operations (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker against exposed SCIM API endpoints. The EPSS score is approximately 0.0017 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing ZITADEL instances running versions 2.68.0–2.71.19, 3.0.0–3.4.7, or 4.0.0–4.12.1 using tools like Shodan or Censys, searching for ZITADEL login pages or API endpoints.
2. Identify SCIM API endpoint: Locate the SCIM API base URL, typically at a path such as /scim/v2/ on the ZITADEL instance.
3. Craft URL-encoded request: Construct an HTTP GET request to a SCIM resource endpoint using URL-encoded path separators (e.g., replacing / with %2F) in the path, such as GET /scim%2Fv2%2FUsers or similar encoded variants.
4. Bypass authentication: Submit the crafted request without any authentication headers. The router correctly resolves the encoded path and dispatches the request, while the auth middleware skips checks due to the unresolved encoding.
5. Retrieve user data: Parse the API response to extract sensitive user records including names, email addresses, phone numbers, addresses, external IDs, and roles (GitHub Advisory).

• Network: Unusual HTTP GET requests to SCIM API endpoints (e.g., paths containing /scim/) originating from unexpected or unauthenticated sources; requests with URL-encoded path separators (%2F) in SCIM API paths.
• Logs: ZITADEL access logs showing SCIM API requests (HTTP 200 responses) without associated authentication tokens or session identifiers; repeated enumeration of /scim/v2/Users or similar endpoints from a single IP.
• Behavioral: Bulk or sequential retrieval of user records from the SCIM API without a corresponding provisioning workflow or known SCIM provider activity.

ZITADEL has released patched versions addressing this vulnerability: upgrade to 3.4.8 or later for the 3.x branch (also applicable to 2.x users), or 4.12.2 or later for the 4.x branch. As a temporary workaround for organizations that cannot immediately upgrade and do not rely on the SCIM API, access to the SCIM API endpoints can be blocked via a reverse proxy or WAF rule. Organizations should also review SCIM API access logs for anomalous unauthenticated requests as part of incident assessment (GitHub Advisory, v3.4.8 Release, v4.12.2 Release).

The vulnerability was reported by security researcher odgrso and credited in the official ZITADEL advisory. Social media activity was limited but included mentions on Mastodon and Bluesky shortly after disclosure. No major media coverage or significant community controversy has been observed, consistent with the absence of active exploitation (GitHub Advisory).