Authentication Bypass in ZITADEL Login UI by ZITADEL

CVE-2026-105215

What is CVE-2026-105215?

ZITADEL versions prior to 3.4.14 and 4.x versions below 4.16.2 are susceptible to an authentication bypass due to a flaw in the hosted Login V1 UI. The vulnerability arises because the 'external account not found' registration endpoint improperly trusts client-supplied external identity fields without ensuring a completed Identity Provider (IdP) callback. Attackers can exploit this weakness by submitting forged IDPConfigID and ExternalUserID values, enabling them to pre-create accounts associated with a victim's external IdP identity. Consequently, when the victim subsequently attempts to log in with their legitimate external credentials, they may inadvertently authenticate to the attacker's pre-hijacked account.

References