CVE-2026-54693
Received
Received - Intake
Email Verification Bypass in ZITADEL
Vulnerability report for CVE-2026-54693, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-29
Last updated on: 2026-07-29
Assigner: GitHub, Inc.
Description
Description
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 2.43.0 (inc) to 2.71.19 (inc) |
| zitadel | zitadel | From 3.0.0 (inc) to 3.4.11 (exc) |
| zitadel | zitadel | From 4.0.0 (inc) to 4.15.1 (exc) |
| zitadel | zitadel | 3.4.11 |
| zitadel | zitadel | 4.15.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
