CVE-2026-105209

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-05

Assigner: VulnCheck

Description

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105209

EUVD

EUVD-2026-92102

Affected Vendors & Products

Vendor	Product	Version / Range
zitadel	zitadel	0
zitadel	zitadel	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ZITADEL versions before 3.4.15 and 4.17.1 have an improper authorization flaw. Attackers with user-write permissions in one organization can exploit this by manipulating the x-zitadel-orgid header to obtain enrollment codes for users in another organization. This allows them to register their own authenticator and take over the target account.

Detection Guidance

To detect this vulnerability, check ZITADEL versions before 3.4.15 or 4.17.1. Verify if the x-zitadel-orgid header is properly validated during passkey or passwordless enrollment. Inspect logs for cross-organization enrollment attempts or unauthorized authenticator registrations.

Impact Analysis

If you are a user in an affected ZITADEL instance, an attacker with user-write permissions in another organization could take over your account by adding their authenticator. This could lead to unauthorized access to your data and actions performed under your identity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using unpatched ZITADEL instances may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade ZITADEL to versions 3.4.15 or 4.17.1 or later immediately. If upgrading is not possible, restrict user-write permissions to prevent abuse. Monitor for suspicious enrollment activities and unauthorized authenticator additions.

Hi! I’m here to help you understand CVE-2026-105209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70