PT-2026-104634

CVE-2026-105210

Published

2026-10-04

Updated

2026-10-04

Description by

CVSS 4.0

8.8

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.x through 3.4.14 ZITADEL versions 4.x through 4.17.0

Description A missing authentication flaw exists in the hosted Login V1 UI. The second-factor enrollment and initialization handlers process identify-only sessions before the primary factor is verified. An attacker with knowledge of a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users by analyzing discrepant error messages.

Recommendations Update ZITADEL versions 3.x to 3.4.15. Update ZITADEL versions 4.x to 4.17.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products