CVE-2026-105212: ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ZITADEL 3.x releases before 3.4.14 and 4.x releases before 4.16.2 are affected when using the hosted Login V1 or Login V2 user interfaces. The issue applies to passkey and other authenticator enrollment flows on those UIs.
What does an attacker need to take over an account?
An attacker needs only the victim's login name. No existing password, MFA factor, prior authentication, or user interaction is required.
What is the practical impact of successful exploitation?
An attacker can enroll an authenticator they control during an identify-only login session, then use it to log in as the victim. This bypasses the victim's existing password and MFA protections.