CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

CVE-2026-105211

ZITADEL versions before 4.17.1 are vulnerable to an authentication bypass in Login V2 . This flaw allows unauthenticated attackers to intercept OTP codes delivered via the returnCode delivery type. By knowing a victim's login name who has OTP-Email and OTP-SMS enrolled, an attacker can read both ...

CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

EUVD-2026-92100

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

EUVD-2026-92101

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208

ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 are vulnerable to session hijacking due to the use of unauthenticated, malleable encryption for IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to be accepted for another user's external login intent...

CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105207

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 are vulnerable to an account takeover due to improper verification when linking external identity providers. The User Service V2 AddIDPLink endpoint and identify-only Login V2 sessions fail to verify a primary factor or the caller's pe...

CVE-2026-105206

ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 are vulnerable to an incorrect authorization flaw in the User Service API . The vulnerability exists because the system verifies the user.read permission against the caller's organization rather than the organization that owns the target...

CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

EUVD-2026-92099

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105207: Missing Authentication for Critical Function

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

PT-2026-104636

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

PT-2026-104637

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

PT-2026-104635

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.17.1 Description An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain...

PT-2026-104630

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

PT-2026-104631

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.15 ZITADEL versions 4.0.0 through 4.17.2 Description An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission...

DVIA-v2

DVIA-v2 Powered by 8ksec.io DVIA-v2 written in Swift along with additional vulnerabilities Damn Vulnerable iOS App DVIA is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration...