Search

CVE-2026-105209 - ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

CVE ID : CVE-2026-105209 Published : Oct. 4, 2026, 3:16 p. m. • 4 hours, 15 minutes ago Description : ZITADEL 3. x before 3. 4. 15 and 4. x before 4. 17. 1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account. Severity: 9.6 • CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...