CVE-2026-105215 zitadel CVE debrief

Who should care

System administrators and security teams responsible for managing ZITADEL software and ensuring the security of identity and access management systems should assess exposure and prioritize remediation.

Why it matters

CVE-2026-105215 is a critical authentication bypass vulnerability in ZITADEL software, affecting versions before 3.4.14 and 4.x before 4.16.2. The vulnerability allows unauthenticated attackers to pre-create accounts bound to victim's external IdP identities. System administrators and security teams should assess exposure and prioritize remediation.

• Potential account pre-hijacking via forged external IdP callback requires verification
• Unauthenticated attackers may submit forged IDPConfigID and ExternalUserID values
• Victim's later genuine external login may sign into pre-created account
• Remediation priority for ZITADEL software updates and security measures

Technical summary

The vulnerability is caused by the 'external account not found' registration endpoint trusting client-supplied external identity fields without a completed IdP callback. This allows an unauthenticated attacker to submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity. The affected versions are before 3.4.14 and 4.x before 4.16.2. System administrators and security teams should assess exposure and prioritize remediation. The CVE record and NVD entry provide details about the vulnerability, but the scope of affected deployments and potential impact require further verification.

Defensive priority

High

Recommended defensive actions

• Review and update ZITADEL software to version 3.4.14 or later, or 4.16.2 or later
• Implement additional security measures to prevent account pre-hijacking
• Monitor system logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was discovered in ZITADEL software, which is used for identity and access management. The affected versions are before 3.4.14 and 4.x before 4.16.2. The CVE record and NVD entry provide details about the vulnerability, but the scope of affected deployments and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.