ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment… (CVE-2026-105209)

CVE-2026-105209 describes an improper authorization vulnerability in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1. The vulnerability arises because the enrollment code issuance process for passkey or passwordless authentication checks only the organization specified in the x-zitadel-orgid header, not the actual organization of the target user. Consequently, an attacker with user-write permissions in one organization can request enrollment codes for users in different organizations within the same ZITADEL instance. This enables the attacker to register their own authenticators for those users, leading to account takeover.

The vulnerability allows attackers with user-write permissions in one organization to take over accounts of users in other organizations on the same ZITADEL instance by obtaining enrollment codes and registering authenticators without proper authorization checks. This results in a complete compromise of confidentiality and integrity for affected user accounts. The CVSS v3.1 score is 9.6 (Critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality and integrity.

A fix is available in ZITADEL versions 3.4.15 and later for the 3.x branch and 4.17.1 and later for the 4.x branch. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official patches.