ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and… (CVE-2026-105210)

ZITADEL versions 3.x prior to 3.4.15 and 4.x prior to 4.17.1 have a missing authentication vulnerability in the hosted Login V1 UI. The second-factor enrollment and initialization handlers operate on an identify-only session before any primary authentication factor is verified. This allows an attacker with knowledge of a victim's login name to enroll attacker-controlled second-factor authentication methods such as TOTP, OTP-SMS, OTP-Email, or U2F. Additionally, the attacker can overwrite the victim's verified phone number and enumerate users by analyzing differing error messages.

An attacker can bypass primary factor verification to enroll unauthorized second-factor authentication methods, potentially compromising account security. The attacker can also overwrite verified phone numbers, which may disrupt legitimate user authentication. Furthermore, user enumeration is possible through error message discrepancies, which can aid further targeted attacks. The CVSS score of 8.2 (high severity) reflects the significant impact on confidentiality and integrity, though availability is not affected.

A fix is available in ZITADEL versions 3.4.15 and later for the 3.x branch and 4.17.1 and later for the 4.x branch. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation guidance is provided in the input data. Patch status is confirmed by the version boundaries stated in the description.