zitadel

0 Fork 0

mirror of https://github.com/zitadel/zitadel.git synced 2026-11-02 20:30:51 -06:00

Files

T

Marco A. 450c0560bc fix(idp): reject SAML assertions from a different IdP than the intent

The SAML ACS handler verified the response signature with the IdP from
the request path, but resolved the user under the IdP of the login
intent without comparing the two. Anyone controlling the signing key of
one SAML IdP on an instance could complete a login intent of another
SAML IdP and obtain a session as any user linked to it.

Reject the request when the path IdP does not match the intent's IdP,
in both the ACS and the SLO handler.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit b834f7b1b2)

2026-09-28 06:21:30 +02:00

assets

fix: handle encoded paths in auth middleware

2026-03-11 08:28:38 +01:00

authz

fix: block Login V2 auth for users in deactivated organizations

2026-08-14 07:00:05 +02:00

call

fix: reset the call timestamp after a bulk trigger (#6080 )

2023-07-07 08:15:05 +00:00

grpc

perf(eventstore): order events API by creation date (#12789 )