CVE-2026-105209 in Zitadel
Summary
by MITRE • 10/04/2026
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in ZITADEL versions prior to 3.4.15 and 4.x before 4.17.1 represents a critical failure in multi-tenant access control logic, specifically within the mechanism for issuing passkey or passwordless enrollment codes. This flaw stems from an improper authorization check where the system validates only the organization identifier present in the x-zitadel-orgid request header rather than verifying that this organization matches the actual organizational affiliation of the target user account being modified. In a multi-tenant identity and access management platform, strict isolation between tenants is paramount to ensure data confidentiality and integrity. By relying solely on the client-supplied or session-associated organization ID in the header without cross-referencing it against the authoritative record of the user's assigned organization, the application fails to enforce proper object-level authorization controls. This architectural oversight allows an attacker who possesses write permissions within one tenant context to manipulate requests targeting users belonging to a completely different tenant on the same instance.
From a technical perspective, this vulnerability aligns with CWE-284 Improper Access Control and specifically reflects aspects of CWE-639 Authorization Bypass Through User-Controlled Key. The core issue lies in the trust placed in external input for authorization decisions without sufficient server-side validation against persistent state data. When an authenticated user initiates a request to enroll a passkey or passwordless method, they must specify which account is being modified. In this flawed implementation, if an attacker with write access to Organization A crafts a request that includes the header x-zitadel-orgid set to Organization B, and targets a User ID belonging to Organization B, the system accepts the organization context from the header as valid for authorization purposes. It does not verify whether the user being targeted actually resides within Organization B or if the requester has legitimate administrative rights over that specific user in their own tenant context. This bypass of logical access controls enables unauthorized modification of security credentials across organizational boundaries.
The operational impact of this vulnerability is severe, leading directly to account takeover scenarios for passwordless and passkey-based authentication methods. An attacker with relatively low-privilege write permissions in one organization can escalate their influence by registering a malicious authenticator device as the primary or secondary factor for a high-value user in another organization. Once the enrollment code is obtained and used successfully, the attacker gains full control over that victim's account without needing to know the password or bypass traditional MFA challenges. This effectively neutralizes the security benefits of passkey authentication, which relies on strong cryptographic binding between the device and the identity provider. The ability to inject authenticators across tenants undermines the fundamental trust model of multi-tenant SaaS platforms, potentially leading to data breaches, unauthorized transactions, and reputational damage for both the service provider and its customers.
This behavior is also indicative of weaknesses in how session context and resource ownership are validated during state-changing operations, a pattern often associated with ATT&CK technique T1078 Valid Accounts when used for lateral movement or privilege escalation within identity systems. The vulnerability allows an adversary to leverage existing valid credentials in one domain to compromise identities in another, facilitating broader access across the infrastructure. Mitigation requires immediate upgrading to ZITADEL version 3.4.15 or later, and 4.x versions prior to 4.17.1 are also affected so upgrades must be applied accordingly. The fix involves implementing rigorous server-side validation that ensures the organization ID associated with the user resource matches the authorization context of the requestor. Additionally, developers should audit other endpoints for similar patterns where external headers or parameters dictate access rights without sufficient verification against authoritative data stores to prevent future instances of improper authorization bypasses in identity management workflows.