ZITADEL Login V1 Unauthenticated MFA Enrollment and Phone Overwrite

Vulnerability Overview Title: Login V1: unauthenticated MFA enrollment and phone-number overwrite via ungated init handlers Description: Summary: ZITADEL's hosted Login V1 UI allows unauthenticated attackers, knowing only the victim's username, to register attacker-controlled second factors in the victim's account and overwrite the victim's verified phone number before verifying any password or other primary factor. The MFA registration/initialization handlers run on a login session established solely by submitting the username—after the username is submitted but before the first factor is checked. Impact: Attackers who can access the Login V1 authentication flow and know a valid username (without knowing the password) can: - Register attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F second factors in the victim's account. - Overwrite the victim's verified phone number, including sending SMS verification codes to a phone number chosen by the attacker. - Enumerate users: the registration handlers return different errors for existing and non-existing accounts, bypassing the protection. Scope: This issue alone does not lead to account takeover; the attacker needs to know the victim's password, and Login V1 password reset is only performed via email. The impact lies in the integrity of the victim's account (implantation of attacker-controlled second factors and/or phone numbers) and the confidentiality of user existence (enumeration). Scope Note: This issue affects only Login V1, is instance-scoped (cross-organization) but not cross-instance. Login V2 is not affected by this path. This is the second-factor counterpart to , which closed a vulnerability in passkey registration for password reset but left these 2FA init/registration handlers ungated. Affected Versions Affected Versions: - 4.x: 4.0.0 to 4.17.0 (including RC versions) - 3.x: 3.0.0 to 3.4.14 (including RC versions) Mitigation Patch: - 4.x: Upgrade to >= 4.17.1 - 3.x: Upgrade to >= 3.4.15 Workaround: - The recommended solution is to upgrade to the patched version. There is no configuration that can completely disable this vulnerability on unpatched versions. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: None CVE ID: No known CVE Weaknesses: - CWE-267 - CWE-306 Credits: - Fix Developer: grvjayan - Fix Reviewer: livio-a - Reporter: lucaseddogson - Reporter: AdamKorcz Issues: - If you have any questions or comments, please email security@zitadel.com. Credits: - Thanks to Adam Korczynski (Ada Logics) and Lucas Dodgson (InfoGuard Labs) for reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL Login V1 Unauthenticated MFA Enrollment and Phone Overwrite

More from this source