CVE-2026-105210: ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 are affected when using the hosted Login V1 UI. The issue is in its second-factor enrollment and initialization handlers.
What does an attacker need to exploit this issue?
An attacker needs only the victim's login name. No primary authentication factor, privileges, or user interaction is required.
What actions can an attacker perform?
An attacker can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors and can overwrite the victim's verified phone number. The differing error behavior also enables user enumeration.
How can exposure be remediated?
Upgrade ZITADEL 3.x to 3.4.15 or later, or ZITADEL 4.x to 4.17.1 or later. The provided information does not specify a workaround for deployments that cannot immediately upgrade.