CVE-2026-105207

Summary

This flaw allows unauthenticated attackers to bind their external identity provider accounts to victims' ZITADEL accounts, enabling them to impersonate victims. This is critical as it bypasses authentication and authorization controls.

Exploitability

Exploitation is relatively straightforward for an attacker who knows the victim's login name, as no primary factor verification or caller permission is required.

Blast radius

If exploited, the attacker can fully compromise the victim's account, leading to potential data exfiltration, unauthorized actions, and further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ZITADEL 3.4.16 or 4.17.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.