ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary… (CVE-2026-105207)

The vulnerability in ZITADEL affects versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3. It arises because the system creates links between user accounts and external identity providers without proper verification of a primary authentication factor or the permission of the caller. This flaw exists in identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. Exploitation allows an unauthenticated attacker, knowing only the victim's login name, to bind their own external IdP identity to the victim's account, enabling unauthorized sign-in as the victim.

Successful exploitation results in complete compromise of the victim's account, including confidentiality, integrity, and availability. The attacker can authenticate as the victim without any prior authentication, leading to full account takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor the vendor's advisories for updates and avoid exposing login names publicly where possible until a fix is available.