CVE-2026-105213: ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ZITADEL 4.x versions before 4.17.1 are affected when Login V2 is used. The issue applies to users belonging to organizations that have been deactivated.
What does an attacker need to exploit this issue?
The attacker must be a user of a deactivated organization and have valid credentials, an existing session, or a refresh token. No additional privileges or user interaction are required.
What access can persist after an organization is deactivated?
Affected users can still authenticate, create sessions, obtain tokens, and refresh tokens through Login V2. The available information indicates confidentiality impact is low and integrity impact is high.
How can I determine whether I may already be affected?
Review whether any deactivated organizations have users with valid credentials, active sessions, or refresh tokens, and whether those users authenticated through Login V2. Successful sign-ins, session creation, or token issuance for such users indicates exposure.
What version addresses the issue?
Upgrade to ZITADEL 4.17.1 or later. Versions earlier than 4.17.1 in the 4.x series are affected.