ZITADEL Login V1/V2 accepted passkey enrollment before auth

ZITADEL Login V1 and V2 accepted passkey or authenticator enrollment on identify-only login flows before identity was confirmed. Affects 3.x before 3.4.14 and 4.x before 4.16.2.

cat cve-2026-105212.json

Vendor: ZITADEL
Product: ZITADEL (3.x before 3.4.14 and 4.x before 4.16.2)
CVSS: 7.5
EPSS (exploit probability): 0.3%
Status: patched
Published: October 4, 2026
Source: https://github.com/zitadel/zitadel/security/advisories/GHSA-45f2-5q3r-xgg6

ZITADEL’s Login V1 and V2 UIs accepted passkey and authenticator enrollment requests on identify-only login flows, before the user’s identity was confirmed. The flaw affects both login interface generations.

Affected: ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2.

Fixed in: 3.4.14 and 4.16.2.

Source: GHSA-45f2-5q3r-xgg6.

Related coverage

~/articles/2026-10-05-zitadel-four-auth-bypass-cves

● Breaking

threat intel

ZITADEL Patches Four Auth Bypass Flaws, Two Critical

ZITADEL patched four authentication bypass CVEs this week, including CVE-2026-105207 at CVSS 9.8 and CVE-2026-105215 at CVSS 9.1. None confirmed exploited in the wild.

Oct 5read →