All vulnerabilities
CVE-2026-105215GHSA-738m-7888-jfv8

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

zitadel zitadel
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.16.2Also 3.4.14CVE List
Published4 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.

Text from CVE List

Affected versions 4

  • zitadelaffected: all versions before 4.16.2CVE List
  • zitadelunaffected: 4.16.2CVE List
  • zitadelaffected: all versions before 3.4.14CVE List
  • zitadelunaffected: 3.4.14CVE List

References 2