Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

ZITADEL lets attackers add MFA without password

CVE-2026-105210 · published 14 days ago
Summary

Versions of ZITADEL before 4.17.1 (and 3.x before 3.4.15) allow an unauthenticated user to add new multi‑factor authentication methods using only a known login name. This could let an attacker replace the user’s phone number or create a fake second‑factor method and later use it to access the account. Upgrade ZITADEL to the latest version and review existing MFA configurations.

Original advisory text
ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105210 · NVD
CVE-2026-105210 · OSV
GHSA-72q5-mv5c-vxv4 · GHSA
Track software like this
Free during beta