CVE-2026-105209 - ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
Brief
CVE ID : CVE-2026-105209
Published : Oct. 4, 2026, 3:16 p. m.
- 4 hours, 15 minutes ago
Description : ZITADEL 3. x before 3.
- 15 and 4. x before 4.
- 1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization.
Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
Severity: 9.6
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...