Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD8.8 High

CVE-2026-105210

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zitadel zitadel

Default version status: unaffected

  • 4.0.0 to < 4.17.1affected
  • 4.17.1unaffected

zitadel zitadel

Default version status: unaffected

  • 0 to < 3.4.15affected
  • 3.4.15unaffected

References