Grvijayan

تحتوي واجهة مستخدم Login V1 المستضافة على خلل حيث يقوم معالج تغيير اسم المستخدم بمعالجة الطلبات للحساب المرتبط بتدفق تسجيل الدخول قبل التحقق من أي عوامل مصادقة. يسمح هذا للمهاجمين غير المصرح لهم بتقديم اسم تسجيل دخول الضحية ثم إرسال اسم مستخدم جديد لإعادة تسمية أي مستخدم بشري نشط، بما في ذلك المسؤولين، مما يؤدي إلى منعهم من الوصول إلى حساباتهم.

An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission. This occurs during identify-only Login V2 sessions and via the User Service V2 'AddIDPLink' endpoint. An unauthenticated attacker who knows a victim's login name can bind their own external identity provider identity to the victim's account to hijack it and sign in as the victim.

An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the `x-zitadel-orgid` header but fails to verify the organization of the target user. This allows an attacker with user-write permissions in one organization to obtain an enrollment code for a user belonging to a different organization on the same instance, enabling the attacker to register their own authenticator and take over the account.

A missing authentication flaw exists in the hosted Login V1 UI. The second-factor enrollment and initialization handlers process identify-only sessions before the primary factor is verified. An attacker with knowledge of a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users by analyzing discrepant error messages.