Improper Authorization Risk in ZITADEL Product by ZITADEL

CVE-2026-105209

What is CVE-2026-105209?

ZITADEL versions 3.x prior to 3.4.15 and 4.x prior to 4.17.1 are exposed to an improper authorization vulnerability that enables attackers to exploit passkey or passwordless enrollment processes. The flaw arises from the system's failure to verify the organization affiliation of the target user when issuing enrollment codes. This allows attackers with user-write permissions in one organization to acquire codes intended for users in another organization, enabling them to register their own authenticators and gain unauthorized access to accounts across the same instance.

References