CVE-2026-105210

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.x through 3.4.14 ZITADEL versions 4.x through 4.17.0

Description A missing authentication flaw exists in the hosted Login V1 UI. The second-factor enrollment and initialization handlers process identify-only sessions before the primary factor is verified. An attacker with knowledge of a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users by analyzing discrepant error messages.

Recommendations Update ZITADEL versions 3.x to 3.4.15. Update ZITADEL versions 4.x to 4.17.1.