ZITADEL Improper Authorization in Passkey Enrollment Allowing Cross-Organization Account Takeover

Vulnerability Overview Title: Improper authorization when issuing passkey and passwordless enrollment codes (cross-organization account takeover) Description: ZITADEL allows administrators to initiate passkey or passwordless enrollment for another user by sending a one-time enrollment link (or code). When this link is requested, ZITADEL fails to verify whether the caller is authorized to perform this action within the organization that owns the target user. Consequently, an administrator of one organization can issue enrollment codes for a user in any other organization on the same instance. Impact Scope Affected Versions: - 4.x: 4.0.0 - 4.17.0 - 3.x: 3.0.0 - 3.4.14 Impact: - Attackers can request passkey or passwordless enrollment codes for users in different organizations. - Attackers can register controlled authenticators on the victim's account and take over the account, as the enrollment code allows adding new credentials without further action or verification. - This vulnerability affects the passkey and passwordless enrollment link functionality in all affected APIs. It is a single-instance issue within the cross-organization authorization flow and does not cross instance boundaries. Remediation Patched Versions: - 4.x: Upgrade to 4.17.1 - 3.x: Upgrade to 3.4.15 Workaround: - Upgrading to the patched version is recommended. There is currently no configuration option to completely mitigate this vulnerability in unpatched versions. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: None CVE ID: No known CVE Weakness: CWE-862 Reporters: - rud - r1027 - lythexori - AdamKorcz - IAM-marco - grvjayan Contact: For any questions or comments, please email security@zitadel.com Code Block No Proof of Concept (POC) or exploitation code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL Improper Authorization in Passkey Enrollment Allowing Cross-Organization Account Takeover

More from this source