CVE-2026-105211

Summary

This vulnerability allows unauthenticated attackers to bypass authentication by obtaining OTP codes, potentially taking over accounts and gaining MFA-authenticated sessions, including administrator access.

Exploitability

Exploitation requires knowledge of a victim's login name and access to server-action responses, making it moderately difficult.

Blast radius

If exploited, the impact could be severe, as it allows attackers to take over accounts and gain full access, including administrative privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ZITADEL 4.17.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.