CVE-2026-105209

CRITICAL 9.6

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

CWE	CWE-862
Vendor	zitadel
Product	zitadel
Published	Oct 4, 2026

Stay Ahead of the Next One

Get instant alerts for zitadel zitadel

Be the first to know when new critical vulnerabilities affecting zitadel zitadel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

zitadel / zitadel

0 < 4.17.1

zitadel / zitadel

0 < 3.4.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zitadel/zitadel/security/advisories/GHSA-pq2q-2c6r-75c4 vulncheck.com: https://www.vulncheck.com/advisories/zitadel-before-3.4.15-and-4.17.1-cross-organization-account-takeover-via-passkey-enrollment

Credits

🔍 rud 🔍 rz1027 🔍 lyhtheori 🔍 AdamKorcz IAM-marco grvijayan