Is CVE-2026-105210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105210 being exploited in the wild.

How severe is CVE-2026-105210?

High severity, with a CVSS score of 8.2, published 4 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 through 3.4.14, 4.0.0 through 4.17.0.

Is there a fix for CVE-2026-105210?

Yes: fixed in ZITADEL 3.4.15, 4.17.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105210 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105210?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105210: ZITADEL missing authentication in Login V1 MFA enrollment

CVE-2026-105210 · Severity: high · CVSS 8.2 · Published 2026-10-04

ZITADEL is an identity and access management platform that handles user authentication and authorization. A flaw in its hosted Login V1 UI allows attackers who know only a victim's username to enroll their own multi-factor authentication methods (TOTP, SMS, email codes, security keys) and change the victim's phone number before the victim has even entered a password. This compromises account integrity and enables user enumeration, creating a foothold for account takeover if combined with other attacks.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-105210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105210 being exploited in the wild.
How severe is CVE-2026-105210?: High severity, with a CVSS score of 8.2, published 4 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 through 3.4.14, 4.0.0 through 4.17.0.
Is there a fix for CVE-2026-105210?: Yes: fixed in ZITADEL 3.4.15, 4.17.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105210 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105210?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ZITADEL 3.4.15, 4.17.1

Technical details

An unauthenticated attacker can exploit missing authentication checks on second-factor enrollment handlers in ZITADEL's Login V1 UI. These handlers process requests at the identify-only session stage (after username submission but before primary factor verification), allowing attackers to modify the victim's authentication factors and phone number. The vulnerability also discloses user existence via differential error messages, and affects all OIDC/SAML flows using the hosted Login V1 interface.

Affected products

ZITADEL ZITADEL 3.0.0 through 3.4.14, 4.0.0 through 4.17.0

Timeline

2026-08-14: disclosed
2026-10-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.