CVE-2026-105215 in Zitadel
Summary
by MITRE • 10/04/2026
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in ZITADEL versions prior to 3.4.14 and 4.x before 4.16.2 represents a critical authentication bypass within the hosted Login V1 user interface, specifically targeting the registration workflow for external identity providers. This flaw stems from an insecure direct object reference or improper validation of client-supplied input during the account creation process. When a new user attempts to register using an external identity provider such as Google, GitHub, or Microsoft Azure AD, the system is designed to verify that the external account does not already exist before proceeding with authentication callbacks. However, in vulnerable versions, the endpoint responsible for handling cases where an external account is initially reported as not found fails to enforce strict validation on the identifiers provided by the client side during this pre-registration phase. Specifically, the application trusts the IDPConfigID and ExternalUserID values submitted by the attacker without ensuring that a legitimate callback from the Identity Provider has been completed or verified at that stage. This architectural oversight allows an unauthenticated actor to manipulate these fields arbitrarily rather than relying on cryptographically signed assertions received directly from the trusted IdP service.
The operational impact of this vulnerability is severe, as it enables account pre-creation and subsequent authentication bypass for targeted victims. An attacker can exploit this by submitting forged IDPConfigID and ExternalUserID values that correspond to a specific victim's identity provider credentials. By doing so, the system creates a new local user profile in ZITADEL bound to those external identifiers before the victim has ever attempted to log in. When the legitimate victim subsequently attempts to authenticate using their standard external login flow, the Identity Provider returns valid authentication tokens confirming the user's identity. The vulnerable application then matches these incoming credentials against the pre-created account associated with that same ExternalUserID and IDPConfigID. Consequently, instead of initiating a new registration or presenting an error indicating no existing account, the system automatically logs the attacker-controlled session into what is effectively the victim's account. This results in full unauthorized access to all data, settings, and permissions associated with the targeted user profile, constituting a complete compromise of identity integrity and confidentiality.
From a classification perspective, this vulnerability aligns closely with CWE-287, which denotes Improper Authentication, as well as CWE-601, URL Redirection to Untrusted Site (Open Redirect), insofar as it involves the manipulation of state through unvalidated inputs leading to unauthorized access. In terms of the MITRE ATT&CK framework, this behavior is characteristic of T1078 Valid Accounts, where an attacker gains initial access by exploiting legitimate credentials or account structures rather than breaking them directly. It also reflects aspects of T1136 Create Account, as the vulnerability allows for the silent creation of a user profile that can be leveraged for persistent unauthorized access. The root cause is fundamentally rooted in CWE-20 Improper Input Validation, where the application fails to verify that the data received from the client corresponds strictly to verified assertions from the external identity provider before establishing a session or account linkage.
Mitigation strategies must focus on enforcing strict validation protocols at every stage of the authentication and registration lifecycle. The primary remediation is to upgrade ZITADEL to version 3.4.14 or later, which includes patches that correct this logic flaw by ensuring that external identity fields are only accepted after a successful callback from the IdP has been verified. For organizations unable to immediately patch, defensive measures should include implementing strict server-side validation of all registration requests to ensure they originate exclusively from trusted IdP callbacks rather than direct client submissions. Additionally, enabling multi-factor authentication for administrative and high-privilege accounts can provide an additional layer of security that may mitigate the impact if such a bypass is attempted. Regular auditing of user creation logs for anomalies, such as rapid account creations linked to specific external identifiers without corresponding login attempts from known IP ranges, can also aid in early detection of exploitation attempts.