CVE-2026-105212 - ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
Brief
CVE ID : CVE-2026-105212
Published : Oct. 4, 2026, 3:16 p. m.
- 4 hours, 15 minutes ago
Description : ZITADEL 3. x before 3.
- 14 and 4. x before 4.
- 2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified.
Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.
Severity: 8.7
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...