CVE-2026-105210 in Zitadel
Summary
by MITRE • 10/04/2026
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in ZITADEL versions 3.x prior to 3.4.15 and 4.x prior to 4.17.1 represents a critical authentication bypass within the hosted Login V1 user interface, specifically affecting the handlers responsible for second-factor enrollment and initialization. This flaw stems from an improper sequence of identity verification steps during the multi-factor authentication setup process. Under normal operational logic, a session should require successful primary factor validation before allowing any modifications to security settings or secondary factors. However, in these affected versions, the system permits actions related to configuring two-step verification methods while the user is still in an identify-only state, meaning only their username has been provided but not yet authenticated with a password or equivalent primary credential. This architectural oversight allows unauthenticated actors to interact directly with sensitive configuration endpoints without proving ownership of the account through standard login procedures.
The operational impact of this flaw is severe, as it enables attackers who possess only a victim's login name to take full control over the secondary authentication mechanisms associated with that account. By exploiting the missing primary factor verification, an attacker can enroll their own time-based one-time password (TOTP) secret, register SMS or email-based OTP endpoints, and even bind U2F hardware security keys to the target identity. Furthermore, the vulnerability allows for the overwrite of verified contact information such as phone numbers, effectively severing the legitimate user's access to recovery channels while establishing attacker-controlled pathways for future authentication attempts. This capability fundamentally undermines the integrity of the multi-factor authentication framework, transforming a protective measure into an attack vector that facilitates account takeover without requiring knowledge of the primary password or existing second factors.
Beyond direct account compromise, this vulnerability also aids in user enumeration and reconnaissance activities within the ZITADEL ecosystem. The system exhibits discrepant error responses depending on whether specific actions are attempted against valid versus invalid identities during the enrollment process. Attackers can leverage these subtle differences in feedback to determine if a particular login name exists in the directory or is associated with active accounts, thereby facilitating targeted phishing campaigns or further exploitation attempts. This side-channel information leakage complements the primary authentication bypass by allowing adversaries to map out potential targets and prioritize high-value identities for subsequent attacks that may not rely solely on this specific flaw but benefit from accurate user intelligence.
From a classification perspective, this issue aligns with CWE-287, which describes Improper Authentication, specifically relating to cases where identity verification is skipped or bypassed during critical security operations. It also relates closely to CWE-640, Weak Password Recovery Mechanism for Forgotten Password, as the ability to overwrite verified phone numbers and enroll new second factors effectively hijacks the account recovery process. In terms of offensive tactics, this vulnerability maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or, in this case, valid identity information combined with authentication logic flaws to gain initial access. Additionally, the enumeration aspect corresponds to T1082, System Information Discovery, as it allows for the confirmation of user existence within the system through error analysis.
Mitigation strategies must prioritize immediate upgrading to ZITADEL version 3.4.15 or later if running on the 3.x branch, or version 4.17.1 and above for those on the 4.x branch, as these releases contain patches that enforce strict ordering of authentication steps before allowing secondary factor configuration. For organizations unable to patch immediately due to operational constraints, implementing a Web Application Firewall (WAF) rule set can provide temporary protection by monitoring and blocking requests to second-factor enrollment endpoints from sessions lacking valid primary authentication tokens or session identifiers indicating completed login flows. Security teams should also audit their identity provider configurations to ensure that no custom integrations bypass standard ZITADEL security middleware, as third-party extensions might inadvertently expose similar logic flaws if they replicate the flawed pattern of allowing configuration changes prior to full credential verification. Continuous monitoring for unusual enrollment activities or rapid succession of second-factor registrations from single IP addresses can also help detect exploitation attempts in real-time before account takeover occurs.