Is CVE-2026-109374 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109374?

CVE-2026-109374 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-109374

Description

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.