CVE-2026-105209

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.x through 3.4.14 ZITADEL versions 4.x through 4.17.0

Description An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the x-zitadel-orgid header but fails to verify the organization of the target user. This allows an attacker with user-write permissions in one organization to obtain an enrollment code for a user belonging to a different organization on the same instance, enabling the attacker to register their own authenticator and take over the account.

Recommendations Update ZITADEL versions 3.x to 3.4.15 or later. Update ZITADEL versions 4.x to 4.17.1 or later.