CVE-2026-105207 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL instances, identity and access management systems, and associated security infrastructure should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their environments are protected against this vulnerability to prevent account takeovers and unauthorized access.

Why it matters

CVE-2026-105207 allows unauthenticated attackers to bind their external IdP identity to a victim's account and sign in as the victim, potentially leading to account takeover and unauthorized access.

• Potential account takeover via external IDP linking
• Bypass of primary factor verification and caller permission checks
• Unauthenticated access to victim accounts
• Possible lateral movement within ZITADEL instances

Technical summary

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim. This vulnerability allows for potential account takeover and unauthorized access, emphasizing the need for defenders to verify and remediate ZITADEL instances promptly to prevent such attacks.

Defensive priority

Defenders should prioritize verifying and remediating ZITADEL instances to prevent account takeover via external IDP linking.

Recommended defensive actions

• Verify ZITADEL instance versions and configurations to identify potential exposure
• Remediate vulnerable ZITADEL instances by updating to version 4.17.3 or later
• Implement additional authentication and authorization controls to prevent account takeover
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3. An unauthenticated attacker can bind their own external IdP identity to a victim's account and then sign in as the victim.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.