ZITADEL: Missing authorization in passkey enrollment enables account takeover
Summary
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 does not check the organization of the target user when issuing passkey or passwordless enrollment codes. It only checks the organization named in the x-zitadel-orgid header. An attacker with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance, register their own authenticator and take over that account. The flaw matters only on instances hosting several organizations and requires an authenticated account with user-write permission. The CVE record scores it 9.3 (CVSS v4.0); the GitHub advisory scores it 9.6 (CVSS v3.1).
Affected
- ZITADEL 4.0.0 to 4.17.0 (including RC versions)
- ZITADEL 3.0.0 to 3.4.14 (including RC versions)
Fixed in
- ZITADEL 4.17.1 or later (4.x)
- ZITADEL 3.4.15 or later (3.x)
Workaround
- No vendor workaround for unpatched versions; the vendor states that no configuration fully closes the gap.
- Interim measure (not from the advisory): restrict user-write and user-management permissions to the minimum needed.
Exploitation
- No public exploitation or in-the-wild use reported.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- EPSS reported as low (0.0022).
- Public proof of concept not confirmed.
Our recommendation
- Check whether your ZITADEL instance is self-hosted or cloud-hosted, which version runs, and whether it contains more than one organization.
- Upgrade to 4.17.1 or later, or to 3.4.15 or later for 3.x. A news report states that 3.x reached end of life on August 31, 2026; this is not verified on the vendor site. If confirmed, plan a move to 4.x.
- Review passkey and passwordless enrollment events for cross-organization activity and rotate admin credentials if suspicious activity is found.
- Reduce user-write permissions and monitor changes to users and authenticators.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pq2q-2c6r-75c4 github.com
- VulnCheck advisory for CVE-2026-105209 www.vulncheck.com
- OSV entry for CVE-2026-105209 osv.dev
- CVE score mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:30.
Original description (NVD)
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.