Is CVE-2026-105209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105209 being exploited in the wild.

How severe is CVE-2026-105209?

Critical severity, with a CVSS score of 9.6, published 4 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 to 3.4.14; 4.0.0 to 4.17.0.

Is there a fix for CVE-2026-105209?

Yes: fixed in 3.4.15, 4.17.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105209 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105209?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105209: ZITADEL improper authorization in passkey and passwordless enrollment

CVE-2026-105209 · Severity: critical · CVSS 9.6 · Published 2026-10-04

ZITADEL is an identity and access management platform. An administrator with user permissions in one organization can issue enrollment codes to hijack user accounts in other organizations on the same instance, gaining full account control without the victim's interaction. This allows cross-organization account takeover, exposing sensitive customer and organizational data.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-105209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105209 being exploited in the wild.
How severe is CVE-2026-105209?: Critical severity, with a CVSS score of 9.6, published 4 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 to 3.4.14; 4.0.0 to 4.17.0.
Is there a fix for CVE-2026-105209?: Yes: fixed in 3.4.15, 4.17.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105209 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105209?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.15, 4.17.1

Technical details

An improper authorization vulnerability in passkey and passwordless enrollment code issuance: the system checks only the organization in the x-zitadel-orgid header rather than the target user's organization, failing to enforce proper authorization boundaries. An attacker with user-write permission in one organization can request enrollment codes for users in other organizations and enroll their own authenticators, achieving account takeover. The flaw is in code creation; the redemption flow itself is not vulnerable.

Affected products

ZITADEL ZITADEL 3.0.0 to 3.4.14; 4.0.0 to 4.17.0

Timeline

2026-08-14: disclosed
2026-10-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.