Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105212— ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

Quick assessment

Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZITADEL 3.x 版本在 3.4.14 之前，以及 4.x 版本在 4.16.2 之前，存在身份验证绕过漏洞。该漏洞出现在托管版登录界面 Login V1 和 Login V2 中，这些界面允许在未验证任何主认证因素（primary factor）的情况下，仅通过标识符（identify-only）登录会话完成 passkey 或其他认证器的注册。攻击者只要知道受害者的登录用户名，即可注册由其控制的认证器，并以该用户身份登录，从而绕过现有的密码和多重身份认证（MFA）机制。

CVSS 7.5 · High

Affected Version Matrix 4

VendorProduct Version RangeStatus
zitadel zitadel < 4.16.2 affected
4.16.2 unaffected
< 3.4.14 affected
3.4.14 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105212

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zitadel zitadel 0 ~ 4.16.2 -
zitadel zitadel 0 ~ 3.4.14 -

II. Public POCs for CVE-2026-105212

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105212

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-105212 (1)

News Coverage for CVE-2026-105212 (1)

Same Patch Batch · zitadel · 2026-10-04 · 10 CVEs total

CVE-2026-105207 9.8 CRITICAL ZITADEL before 4.17.3 Account Takeover via External IdP Linking
CVE-2026-105209 9.6 CRITICAL ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmen
CVE-2026-105215 9.1 CRITICAL ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
CVE-2026-105210 8.2 HIGH ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
CVE-2026-105213 8.2 HIGH ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
CVE-2026-105211 8.1 HIGH ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
CVE-2026-105208 7.7 HIGH ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
CVE-2026-105206 5.3 MEDIUM ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Servic
CVE-2026-105214 2.3 LOW Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

IV. Related Vulnerabilities

Same product: zitadel
Same vendor: zitadel
Same weakness: CWE-287

V. Comments for CVE-2026-105212

No comments yet

Leave a comment