Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-105213: ZITADEL lets deactivated organization users sign in
CVE-2026-105213 · published 14 days ago
Summary
If you run ZITADEL version earlier than 4.17.1, the system checks only the individual user, not whether the whole organization has been disabled. This means people from a shut‑down organization can still log in, keep active sessions, or obtain new authentication tokens. Update ZITADEL to version 4.17.1 or later and review any active sessions from disabled organizations.
Original advisory text
ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
- https://github.com/zitadel/zitadel/security/advisories/GHSA-558c-v5wc-9w4q
- https://nvd.nist.gov/vuln/detail/CVE-2026-105213 Vendor Advisory
- https://www.vulncheck.com/advisories/zitadel-before-4.17.1-authentication-bypass...
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta