All vulnerabilities
CVE-2026-105210GHSA-72q5-mv5c-vxv4

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

zitadel zitadel
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.17.1Also 3.4.15CVE List
Published4 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

Text from CVE List

Affected versions 4

  • zitadelaffected: all versions before 4.17.1CVE List
  • zitadelunaffected: 4.17.1CVE List
  • zitadelaffected: all versions before 3.4.15CVE List
  • zitadelunaffected: 3.4.15CVE List

References 2