ZITADEL CVE-2026-105212

Exploitation requires that the target deployment uses ZITADEL's hosted Login V1 or Login V2 UI, where authenticator (passkey) enrollment is erroneously accepted on identify-only login sessions before any primary factor is verified. The attacker must know a valid victim login name (username/email); no password, MFA, prior authentication, or victim interaction is needed (PR:N/UI:N). The practical limiting factors are therefore (1) use of the affected hosted login flows and (2) knowledge of a valid login name - a low barrier since login names are typically non-secret. Self-hosted instances on versions 3.x before 3.4.14 or 4.x before 4.16.2 that expose the hosted login UI to attackers are in scope.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack with no user interaction and no special attack requirements - the easiest possible exploitation profile. The impact is an authentication bypass leading to full account takeover (VC:H), which is the core security promise of an identity provider, making the real-world consequence severe even though the vendor scored only confidentiality impact (VI:N/VA:N); in practice account takeover also carries integrity consequences, which the vendor vector arguably understates. The only practical barrier is that the attacker must know a valid victim login name, which is typically low-entropy (email/username) and not secret. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the priority here is driven by exploitability and impact rather than observed in-the-wild activity. Defenders running affected ZITADEL versions should treat this as urgent despite the absence of KEV/EPSS signals, because the attack bypasses both passwords and MFA.

An unauthenticated attacker who knows a target user's login name (e.g. their email) initiates a login on ZITADEL's hosted Login V1 or V2 UI and, on the identify-only session before any password or MFA is verified, enrolls an attacker-controlled passkey/authenticator. The attacker then completes login as the victim using their own authenticator, fully bypassing the victim's existing password and MFA. No public exploit code was identified in the provided data, but the attack is low-complexity and requires no victim interaction.