CVE-2026-105209GHSA-pq2q-2c6r-75c4
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
zitadel zitadel
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
Text from CVE List
Affected versions 4
- zitadelaffected: all versions before 4.17.1CVE List
- zitadelunaffected: 4.17.1CVE List
- zitadelaffected: all versions before 3.4.15CVE List
- zitadelunaffected: 3.4.15CVE List