CVE-2026-105209: ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
ZITADEL instances running 3.x before 3.4.15 or 4.x before 4.17.1 are affected where users from multiple organizations exist on the same instance. The attacker must have user-write permission in at least one organization.
What does an attacker need to exploit it?
The attacker needs authenticated access with user-write permission in one organization and the ability to request a passkey or passwordless enrollment code while supplying an organization ID header. No user interaction is required.
Can this lead to compromise of users outside the attacker's organization?
Yes. The authorization check uses the organization specified in the x-zitadel-orgid header rather than the target user's organization, allowing a permitted user in one organization to request enrollment for a user in another organization on the same instance. The attacker can then register an authenticator and take over the target account.