ZITADEL Login V1 registration endpoint trusts client data

ZITADEL Login V1 UI trusted client-supplied external account data in the 'external account not found' registration endpoint, allowing auth bypass. CVSS 9.1.

cat cve-2026-105215.json

Vendor: ZITADEL
Product: ZITADEL (before 3.4.14 and 4.x before 4.16.2; fixed in 3.4.14 and 4.16.2)
CVSS: 9.1
EPSS (exploit probability): 0.3%
Status: patched
Published: October 4, 2026
Source: https://github.com/zitadel/zitadel/security/advisories/GHSA-738m-7888-jfv8

The hosted Login V1 UI in ZITADEL contained an authentication bypass in the “external account not found” registration endpoint: the endpoint trusted client-supplied external account data without server-side verification. Rated critical at CVSS 9.1.

Affected: ZITADEL before 3.4.14 and 4.x before 4.16.2.

Fixed in: 3.4.14 and 4.16.2.

Source: GHSA-738m-7888-jfv8.

Related coverage

~/articles/2026-10-05-zitadel-four-auth-bypass-cves

● Breaking

threat intel

ZITADEL Patches Four Auth Bypass Flaws, Two Critical

ZITADEL patched four authentication bypass CVEs this week, including CVE-2026-105207 at CVSS 9.8 and CVE-2026-105215 at CVSS 9.1. None confirmed exploited in the wild.

Oct 5read →