Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105212ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

High 7.5

In plain English

A high-severity improper authentication in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.

Affected products (as reported)

Vendor	Product	Versions
zitadel	zitadel	4.0.0 – before 4.16.2
zitadel	zitadel	0 – before 3.4.14

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-45f2-5q3r-xgg6) vendor-advisory
VulnCheck Advisory: ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment third-party-advisory