CVE-2026-54693

Deferred Deferred - Pending Action

Email Verification Bypass in ZITADEL

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54693

Affected Vendors & Products

Vendor	Product	Version / Range
zitadel	zitadel	From 2.43.0 (inc) to 2.71.19 (inc)
zitadel	zitadel	From 3.0.0 (inc) to 3.4.11 (exc)
zitadel	zitadel	From 4.0.0 (inc) to 4.15.1 (exc)
zitadel	zitadel	3.4.11
zitadel	zitadel	4.15.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

ZITADEL is an identity management platform with a vulnerability in versions 2.43.0 through 2.71.19, 3.0.0 to 3.4.11, and 4.0.0 to 4.15.1. The issue allows users to request verification codes for email or phone numbers without proper permissions, enabling them to claim ownership of accounts they do not control.

Detection Guidance

Check ZITADEL versions between 2.43.0-2.71.19, 3.0.0-3.4.11, or 4.0.0-4.15.1. Review logs for unusual email or phone verification code requests in internal/command/user_v2_email.go, user_v2_phone.go, or user_v2_human.go paths.

Impact Analysis

An attacker could exploit this to take over accounts by verifying email or phone ownership without permission. This bypasses security policies relying on email or phone verification, potentially leading to unauthorized access to sensitive data or systems.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and authentication, such as GDPR's data protection principles or HIPAA's security rules. Unauthorized account access risks exposing protected health or personal data.

Mitigation Strategies

Upgrade ZITADEL to versions 3.4.11 or 4.15.1 or later. If upgrading is not possible, restrict user permissions to prevent unauthorized verification code requests.

Hi! I’m here to help you understand CVE-2026-54693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70