CVE-2026-105210 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL deployments, particularly those using Login V1 UI, should assess exposure and prioritize remediation. They should verify and upgrade to patched ZITADEL versions, restrict access to Login V1 UI, and monitor for suspicious MFA enrollment attempts. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

Defenders should care about CVE-2026-105210 because it allows attackers to bypass primary factor verification and enroll MFA factors, potentially leading to unauthorized access and account takeover.

• Attackers can enroll TOTP, OTP-SMS, OTP-Email, or U2F factors without primary factor verification.
• Verified phone numbers can be overwritten by attackers.
• User enumeration is possible through discrepant errors.

Technical summary

The vulnerability exists in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1, where the second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. This allows attackers to bypass primary factor verification and enroll MFA factors, potentially leading to unauthorized access and account takeover. Defenders should prioritize verifying and upgrading to patched ZITADEL versions, restricting access to Login V1 UI, and monitoring for suspicious MFA enrollment attempts.

Defensive priority

Defenders should prioritize verifying and upgrading to patched ZITADEL versions, restricting access to Login V1 UI, and monitoring for suspicious MFA enrollment attempts.

Recommended defensive actions

• Verify and upgrade to patched ZITADEL versions
• Restrict access to Login V1 UI
• Monitor for suspicious MFA enrollment attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE description and source references indicate a missing authentication flaw in ZITADEL's Login V1 UI, allowing attackers to enroll MFA factors and overwrite verified phone numbers. The flaw exists in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1. Defenders should verify and upgrade to patched versions, restrict access to Login V1 UI, and monitor for suspicious MFA enrollment attempts. Official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.