CVE-2026-33132: 
NixOS vulnerability analysis and mitigation

CVE-2026-33132 is an authentication bypass vulnerability in Zitadel, an open-source identity management platform, that allows users to circumvent organization context enforcement during authentication. The flaw affects Zitadel versions 3.0.0 through 3.4.8 and 4.0.0 through 4.12.2 (including RC versions). It was reported by researcher @motoki317, disclosed via GitHub Advisory on March 17, 2026, and published to the NVD on March 20, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an incorrect/missing authorization check (CWE-863, CWE-306) in Zitadel's device authorization flow and the newer Login V2 and OIDC API V2 endpoints. Zitadel supports organization-scoped authentication via scopes such as urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}, which are intended to restrict sign-in to users belonging to a specific organization. While these controls were correctly enforced for OAuth2/OIDC authorization requests in Login V1, the enforcement logic was absent for device authorization requests and all Login V2/OIDC API V2 endpoints, allowing any authenticated user — regardless of organization membership — to complete the flow. The patch (commit d90285929ca0) adds assertOrgScope validation during authorization request creation and adds session-level checks to prevent users from other organizations from completing the CreateCallback and AuthorizeOrDenyDeviceAuthorization endpoints (GitHub Advisory, Patch Commit).

Successful exploitation allows a user from one organization to authenticate into an application that has restricted sign-in to a different organization, effectively bypassing tenant isolation controls. The primary impact is a low-severity confidentiality breach — an unauthorized user may gain access to resources or sessions scoped to another organization. Importantly, applications that rely on Zitadel's authorization/role assignment system are not affected by this bypass, limiting the blast radius; however, applications relying solely on the organization scope enforcement for access control are directly at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The vulnerability requires no privileges and no user interaction, making it trivially exploitable by any network-accessible attacker who possesses valid credentials in any organization on the Zitadel instance. The EPSS score is approximately 0.077% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate a Zitadel instance running a vulnerable version (3.0.0–3.4.8 or 4.0.0–4.12.2) that hosts multiple organizations, where at least one application enforces an organization scope restriction.
2. Obtain credentials: Register or obtain valid credentials for a user in Organization B (an organization that is not the one enforced by the target application).
3. Initiate device authorization flow: Send a device authorization request to the Zitadel OIDC device authorization endpoint (e.g., /oauth/v2/device_authorization) for the target application's client ID, including the organization scope urn:zitadel:iam:org:id:{target_org_id} in the scope parameter.
4. Authenticate as cross-org user: Complete the device authorization flow by authenticating with the Organization B user credentials via the Login V2 or OIDC API V2 endpoints, which lack the organization enforcement check.
5. Bypass enforcement: Because the device authorization and V2 endpoints do not validate that the authenticating user belongs to the required organization, the flow completes successfully and issues tokens granting access to the application (GitHub Advisory, Patch Commit).

• Logs: Zitadel audit logs showing successful OIDC token issuance for a user whose organizationId does not match the organization ID specified in the urn:zitadel:iam:org:id:{id} or urn:zitadel:iam:org:domain:primary:{domain} scope of the authorization request.
• Logs: Device authorization flow completions (AuthorizeOrDenyDeviceAuthorization endpoint calls) where the session's user organization differs from the requested organization scope.
• Logs: CreateCallback OIDC API V2 endpoint invocations where the session user's organizationId does not match the enforced organization in the auth request.
• Network: Unexpected cross-organization authentication patterns — users from one organization successfully obtaining tokens for applications restricted to a different organization.

Zitadel has released patched versions that resolve this vulnerability: upgrade to 3.4.9 (for 3.x deployments) or 4.12.3 (for 4.x deployments). No configuration-based workaround is available; the vendor's recommended solution is to upgrade immediately. Organizations that rely exclusively on Zitadel's organization scope enforcement (rather than role/authorization assignments) for access control should treat this as a high-priority upgrade (GitHub Advisory, v3.4.9 Release).

The vulnerability was reported by community researcher @motoki317 and credited in the official advisory. The Zitadel security team (livio-a) published the advisory and patch on March 17, 2026. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified. The openSUSE security mailing list distributed a related advisory in late March 2026 (openSUSE Security).