All vulnerabilities
CVE-2026-105207GHSA-g8gj-gq47-xgf4

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

zitadel zitadel
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.17.3Fixed versionCVE List
Published4 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.

Text from CVE List

Affected versions 3

  • zitadelaffected: all versions before 4.17.3CVE List
  • zitadelunaffected: 4.17.3CVE List
  • zitadelaffected: all versions through 4.19.4CVE List

References 2