CVE-2026-105213 in Zitadel
Summary
by MITRE • 10/04/2026
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in ZITADEL versions prior to 4.17.1 represents a critical authentication logic flaw rooted in the failure to enforce organizational-level access controls during the Login V2 process. Specifically, the system fails to verify whether an organization is currently inactive or deactivated before proceeding with user credential validation and session creation. This oversight creates a significant gap between identity verification and authorization decisions, allowing users associated with disabled organizations to bypass intended administrative restrictions. The core technical issue lies in the authentication flow where the application checks only the individual user's active status while neglecting the broader context of their organizational affiliation. Consequently, if an organization is marked as inactive by an administrator for reasons such as contract termination, security incident containment, or policy enforcement, the system should immediately revoke access rights. However, due to this missing check, the authentication mechanism continues to accept valid credentials from users within that deactivated entity.
This architectural deficiency has severe operational implications for organizations relying on ZITADEL for identity and access management. Users who possess existing sessions, refresh tokens, or even new login attempts can successfully authenticate and obtain fresh access tokens despite their organization being disabled. This means that previously issued session cookies remain valid, allowing continued interaction with protected resources without requiring re-authentication. Furthermore, the ability to generate new tokens via refresh mechanisms ensures persistent unauthorized access until these specific tokens expire naturally or are manually revoked by an administrator who may not be aware of this bypass capability. For enterprises using ZITADEL as a central identity provider for multiple tenants or internal departments, this flaw undermines the principle of least privilege and complicates incident response efforts during security breaches where immediate isolation of compromised accounts is required.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing organizational boundaries within authentication workflows. It also relates to CWE-613 Insufficient Session Expiration, as the persistence of valid sessions and refresh tokens for deactivated entities extends access beyond intended limits. In terms of adversary behavior mapping under MITRE ATT&CK, this flaw facilitates Initial Access through Valid Accounts (T1078) by allowing attackers or malicious insiders to maintain footholds even after administrative actions have been taken to disable those accounts. It also supports Persistence mechanisms if refresh tokens are exploited to regain access without detection. The lack of organizational state verification effectively neutralizes a key control mechanism designed for rapid response to security events, leaving systems exposed to prolonged unauthorized activity.
Mitigation strategies must prioritize immediate software updates and rigorous configuration reviews. Organizations running ZITADEL versions earlier than 4.17.1 should upgrade to the patched version where this logic has been corrected to include organizational status checks during Login V2 authentication. Until an update is applied, administrators can implement compensating controls by actively revoking all active sessions and invalidating refresh tokens for users belonging to any inactive organization through administrative APIs or console actions. Additionally, implementing stricter token lifetime policies can reduce the window of opportunity for exploitation. Security teams should also audit their identity governance processes to ensure that organizational deactivation triggers automated cascading effects on user access rights across all integrated applications relying on ZITADEL as an authentication provider. Regular penetration testing focusing on edge cases in multi-tenant environments will help identify similar logic flaws before they can be exploited by adversaries seeking persistent unauthorized access.