CVE-2026-105207: ZITADEL account takeover via external identity provider linking

CVE-2026-105207 · Severity: critical · CVSS 9.8 · Published 2026-10-04

ZITADEL is an identity and access management platform used to authenticate users and manage their accounts. An unauthenticated attacker can take over any user account by linking their own external identity provider (such as Google or GitHub) to the victim's account, then signing in as that victim. This requires only knowing the victim's login name and works even when no password or multi-factor authentication has been set up on the account.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-105207 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105207 being exploited in the wild.
How severe is CVE-2026-105207?
Critical severity, with a CVSS score of 9.8, published 4 October 2026.
Which products and versions are affected?
ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.17.2.
Is there a fix for CVE-2026-105207?
Yes: fixed in 4.17.3 and later (3.x line reached end-of-life 2026-08-31 and will not receive a fix). Until then: As a partial mitigation on unpatched versions, disable external identity provider account linking in the organization's login policy to close the Login V2 attack vector; however, this does not prevent exploitation through the User Service V2 API endpoint, which is independent of login-policy configuration. The recommended solution is to upgrade to version 4.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105207 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105207?
Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.17.3 and later (3.x line reached end-of-life 2026-08-31 and will not receive a fix)

As a partial mitigation on unpatched versions, disable external identity provider account linking in the organization's login policy to close the Login V2 attack vector; however, this does not prevent exploitation through the User Service V2 API endpoint, which is independent of login-policy configuration. The recommended solution is to upgrade to version 4.17.3 or later.

Technical details

The vulnerability stems from missing authorization checks when establishing links between user accounts and external identity providers. Two attack vectors exist: (1) the hosted Login V2 UI permits explicit IdP linking on identify-only sessions created by submitting only a login name without verifying any authentication factor, and (2) the User Service V2 AddIDPLink API endpoint skips permission checks when a caller targets their own account. In both cases, the link is created before verifying that a primary factor has been authenticated or that the caller holds required permissions, enabling account takeover via externally-verified identity.

Affected products

  • ZITADEL ZITADEL 3.0.0 through 3.4.15, 4.0.0 through 4.17.2

Timeline

  • 2026-09-04: disclosed: GHSA-g8gj-gq47-xgf4 published by ZITADEL
  • 2026-10-04: advisory: CVE-2026-105207 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.