← Back to the live CVE advisory feed

CVE-2026-105207: zitadel

Severity

9.3 (CRITICAL)

Vendor

ZITADEL

Affected versions

0 through before 4.17.3; 0 through 4.19.4

Fixed version

4.17.3

Patch status

Patched

Published

2026-10-04T15:16:31.677

Modified

2026-10-04T15:16:31.793

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.

View the official NVD record for CVE-2026-105207

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.