ZITADEL: Authentication bypass via account pre-hijacking in Login V1
Summary
ZITADEL's hosted Login V1 UI trusts client-supplied external identity fields in the 'external account not found' registration endpoint. An unauthenticated attacker can pre-create an account bound to a victim's external IdP identity, and the victim's later genuine external login signs into that attacker-prepared account. Exploitation requires that Login V1 is in use and that at least one external IdP allows manual account creation. Login V2 is not affected.
Affected
- ZITADEL 4.0.0 through 4.16.1 (including RC versions)
- ZITADEL 3.0.0 through 3.4.13 (including RC versions)
- Source ranges differ slightly; the CVE record and VulnCheck state 'before 4.16.2' and 'before 3.4.14'.
Fixed in
- ZITADEL 4.16.2 or later (4.x)
- ZITADEL 3.4.14 or later (3.x)
Workaround
- Disable 'Account creation allowed (manually)' on each configured external IdP. This blocks the vulnerable path but also disables legitimate self-service account creation via that IdP.
- Automatic account creation is not affected; with manual creation disabled, the vulnerable path is avoided. If manual creation remains enabled on any IdP, that path stays exposed.
- This is a workaround, not a fix.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV; no confirmed public proof of concept in the sources reviewed.
- Unverified reports of attack traffic exist but are not confirmed for this flaw.
Our recommendation
- Determine whether any ZITADEL instance runs 3.x below 3.4.14 or 4.x below 4.16.2, and whether Login V1 is in use.
- Upgrade to 4.16.2 or 3.4.14 or later, or a newer release that includes other fixes from the same disclosure batch, and verify the deployed version.
- Until patched, disable manual account creation on all external IdPs and confirm the setting in the admin console.
- Review audit logs for external account creations not preceded by an IdP sign-in.
- Treat instances reachable from the internet as the highest priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-738m-7888-jfv8 github.com
- VulnCheck advisory: ZITADEL before 4.16.2 Account Pre-Hijacking www.vulncheck.com
- OffSeq threat radar: CVE-2026-105215 radar.offseq.com
- TheHackerWire: CVE-2026-105215 www.thehackerwire.com
- Tenable: CVE-2026-105215 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:31.
Original description (NVD)
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.