All vulnerabilities
CVE-2026-105212GHSA-45f2-5q3r-xgg6

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

zitadel zitadel
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.16.2Also 3.4.14CVE List
Published4 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.

Text from CVE List

Affected versions 4

  • zitadelaffected: all versions before 4.16.2CVE List
  • zitadelunaffected: 4.16.2CVE List
  • zitadelaffected: all versions before 3.4.14CVE List
  • zitadelunaffected: 3.4.14CVE List

References 2