CVE-2026-105212

Summary

ZITADEL's authentication system allows attackers to bypass primary factor verification by enrolling authenticators on identify-only login sessions, enabling unauthorized access using only a victim's username. This vulnerability affects both Login V1 and Login V2 UIs.

Exploitability

Exploitation is relatively straightforward requiring only knowledge of a victim's username, with no prerequisites beyond access to the affected login interfaces.

Blast radius

The impact could be significant across all ZITADEL instances using affected versions, potentially allowing attackers to gain unauthorized access to user accounts without needing passwords or MFA tokens.

Detection

Monitor for authenticator enrollment events on identify-only login sessions in authentication logs, specifically looking for enrollment attempts that occur without prior password or MFA verification steps.

Prioritized remediation

Upgrade to ZITADEL 3.4.14 or 4.16.2 to remediate this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.