Vulnerability in Zitadel Identity Management Platform's Passkey Registration Endpoints
CVE-2026-32132
7.4HIGH
What is CVE-2026-32132?
Zitadel, an open source identity management platform, has a security issue in its passkey registration endpoints prior to versions 3.4.8 and 4.12.2. The vulnerability arises due to an improper expiration check on registration codes, which can be exploited by an attacker to register a passkey linked to a victim's account. This flaw potentially allows unauthorized access to sensitive account information. The issue has been addressed in the updated versions of the software.
Affected Version(s)
zitadel >= 4.0.0, < 4.12.2 < 4.0.0, 4.12.2
zitadel < 3.4.8 < 3.4.8