ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another users external login intent. An attacker who predicts a victims in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victims IdP tokens or hijack their session.
Weakness
The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.