Description
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zitadel zitadel
Default version status: unaffected
4.0.0 to < 4.17.1affected4.17.1unaffected
zitadel zitadel
Default version status: unaffected
0 to < 3.4.15affected3.4.15unaffected