What is the CVSS score of CVE-2026-32132?

CVE-2026-32132 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zitadel are affected by CVE-2026-32132?

ZITADEL identity management systems running version 3.4.8 or earlier are vulnerable to insufficient session expiration, allowing attackers to maintain unauthorized access to user accounts and…

How to fix or mitigate CVE-2026-32132?

Within 24 hours: Inventory all ZITADEL deployments and document versions currently in use; notify identity and access management teams of the vulnerability. Within 7 days: Implement compensating controls (session timeout enforcement, monitoring for anomalous session activity); evaluate upgrade path to version 3.4.9 or later once available. Within 30 days: Complete upgrade of all ZITADEL instances to patched versions; conduct access reviews for accounts that may have been affected during the vulnerability window.

Zitadel CVE-2026-32132

HIGH

Insufficient Session Expiration (CWE-613)

2026-03-11 security-advisories@github.com

Information Disclosure Zitadel

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 22:16 nvd

HIGH 7.4

DescriptionGitHub Advisory

ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.

AnalysisAI

ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by insufficient session expiration (CVSS 7.4).

Technical ContextAI

This vulnerability (CWE-613: Insufficient Session Expiration) affects ZITADEL is an open source identity management platform.. ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.