ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or… (CVE-2026-105212)

CVE-2026-105212 describes an authentication bypass vulnerability in ZITADEL's hosted Login V1 and Login V2 UIs affecting versions 3.x prior to 3.4.14 and 4.x prior to 4.16.2. The vulnerability arises because the login process accepts passkey or other authenticator enrollment during identify-only sessions before verifying any primary authentication factor. This allows an unauthenticated attacker, knowing only the victim's login name, to register an attacker-controlled authenticator and gain unauthorized access, bypassing passwords and MFA protections.

The vulnerability enables unauthenticated attackers to bypass authentication controls, including passwords and multi-factor authentication, by registering their own authenticators for victim accounts. This leads to a complete compromise of affected user accounts without requiring any credentials, posing a high confidentiality risk. There is no indication of impact on integrity or availability.

A fix is available in ZITADEL versions 3.4.14 and later for the 3.x branch and 4.16.2 and later for the 4.x branch. Users should upgrade to these versions to remediate the authentication bypass vulnerability. No additional mitigation guidance is provided or required beyond applying the official patches.