CVE-2026-105210

High

Description

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

SeverityHigh

CVSS8.2

Exploit probability—

ProductZitadel

PublishedOct 4, 2026

First seenOct 4, 2026

Weakness typeCWE-287Improper authentication

How to fix

Update

zitadel zitadel4.17.1, 3.4.15 or later

Vendor advisories

github.com/zitadel/zitadel/security/advisories/GHSA-72q5-mv5c-vxv4

Affected products

Product	Affected versions	Fixed in
zitadel zitadel	4.0.0 ≤ v < 4.17.1, v < 3.4.15	4.17.1, 3.4.15

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.