CVE-2026-105209
Deferred Deferred - Pending Action

Improper Authorization in ZITADEL Leading to Account Takeover

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulnCheck

Description
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105209
EUVD
EUVD-2026-92102

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
zitadel zitadel to 3.4.15 (exc)
zitadel zitadel to 4.17.1 (exc)
zitadel zitadel to 3.4.15|end_excluding=4.17.1 (exc)
zitadel zitadel From 3.0.0 (inc) to 3.4.14 (inc)
zitadel zitadel From 4.0.0 (inc) to 4.17.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZITADEL versions before 3.4.15 and 4.17.1 have an improper authorization flaw. Attackers with user-write permissions in one organization can exploit this by manipulating the x-zitadel-orgid header to obtain enrollment codes for users in another organization. This allows them to register their own authenticator and take over the target account.

Detection Guidance

To detect this vulnerability, check ZITADEL versions before 3.4.15 or 4.17.1. Verify if the x-zitadel-orgid header is properly validated during passkey or passwordless enrollment. Inspect logs for cross-organization enrollment attempts or unauthorized authenticator registrations.

Impact Analysis

If you are a user in an affected ZITADEL instance, an attacker with user-write permissions in another organization could take over your account by adding their authenticator. This could lead to unauthorized access to your data and actions performed under your identity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using unpatched ZITADEL instances may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade ZITADEL to versions 3.4.15 or 4.17.1 or later immediately. If upgrading is not possible, restrict user-write permissions to prevent abuse. Monitor for suspicious enrollment activities and unauthorized authenticator additions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart