ZITADEL: Account takeover via unverified external IdP linking
Summary
ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 create links between user accounts and external identity providers (IdPs) without verifying a primary factor or the caller's permission. An unauthenticated attacker who knows a victim's login name can bind their own external IdP identity to the victim's account through the Login V2 UI and then sign in as the victim. Any authenticated user can also pre-claim external identities via the User Service V2 AddIDPLink API. The Login V2 path requires an organisation that permits external IdP account linking.
Affected
- ZITADEL 4.0.0 through 4.17.2 (including RC versions)
- ZITADEL 3.0.0 through 3.4.15 (including RC versions)
Fixed in
- ZITADEL 4.17.3 and later (4.x)
- No fixed 3.x release is listed; the vendor states the 3.x line reached end-of-life on 2026-08-31.
Workaround
- Disable external IdP account linking in the affected organisation's login policy. This closes only the Login V2 vector.
- If you cannot upgrade, restrict access to the User Service V2 API at a reverse proxy or firewall (own suggestion, not from the vendor).
- Login V1 is not affected.
Exploitation
- No evidence of exploitation in the wild found. Not listed in the CISA KEV catalogue.
- No public proof of concept confirmed (unverified).
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- EPSS 0.0031 (low).
Our recommendation
- Upgrade self-hosted ZITADEL instances to 4.17.3 or later as the first step.
- Ask ZITADEL for the support status of 3.x and treat 3.x as unpatched until confirmed otherwise.
- Until patched, disable external IdP account linking and restrict exposure of the User Service V2 API.
- Review audit logs for recent IdP link events, whether or not you patch.
- Prioritise internet-facing instances, since they are reachable without credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g8gj-gq47-xgf4 github.com
- VulnCheck advisory: ZITADEL before 4.17.3 Account Takeover via External IdP Linking www.vulncheck.com
- Tenable CVE-2026-105207 www.tenable.com
- OSV CVE-2026-105207 osv.dev
- Forkast: ZITADEL CVE cluster (secondary source) forkast.news
- The Hacker Wire: CVE-2026-105207 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:31.
Original description (NVD)
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.