CVE-2026-105213

8.2 HIGHpublic exploit available

Published 2026-10-04 · Updated 2026-10-05

AI risk analysis

Summary: The flaw allows users of a deactivated organization to still sign in and create sessions, potentially leading to unauthorized access.
Exploitability: Exploitation is relatively easy if an attacker has valid credentials or a refresh token from a deactivated organization.
Blast radius: If exploited, it could lead to unauthorized access and session creation, impacting the security of the affected organization.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to ZITADEL 4.17.1 or later.

auth-bypasswebsessiondeactivated

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses

CWE-287

Public exploit & PoC references

https://github.com/zitadel/zitadel/security/advisories/GHSA-558c-v5wc-9w4q

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.