CVE-2026-105213 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL deployments, particularly those using Login V2 authentication, should assess exposure and verify their organization's status and user authentication configurations.

Why it matters

CVE-2026-105213 is a high-severity vulnerability in ZITADEL that allows users from deactivated organizations to authenticate using Login V2. Defenders should prioritize verifying their ZITADEL organization's status and user authentication configurations to prevent potential unauthorized access and misuse.

• Potential unauthorized access to deactivated organization accounts
• Possible misuse of valid credentials and tokens
• Need for verification of ZITADEL organization status and user authentication configurations
• Potential impact on compliance and regulatory requirements

Technical summary

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, allowing users from deactivated organizations to authenticate and obtain tokens. This oversight in the authentication process enables users with valid credentials from inactive organizations to bypass normal access controls. The vulnerability affects ZITADEL deployments using Login V2 authentication, emphasizing the need for defenders to verify their organization's status and user authentication configurations.

Defensive priority

Defenders should prioritize verifying their ZITADEL organization's status and user authentication configurations.

Recommended defensive actions

• Verify ZITADEL organization status and user authentication configurations
• Check for and apply version 4.17.1 or later
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source references indicate that ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication. Users of a deactivated organization who hold valid credentials can still sign in and obtain tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.