# CVE-2026-105212: ZITADEL authentication bypass in Login UI via passkey enrollment

Source: https://junglewise.ai/threats/cve-2026-105212-zitadel-3-x-before-3-4-14-and-4-x-before-4-16-2-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105212 · Severity: high · CVSS 7.5 · Published 2026-10-04

ZITADEL is an identity and access management platform that hosts user authentication interfaces. An unauthenticated attacker who knows only a victim's username can register a malicious passkey on the victim's account without providing a password or proof of ownership, then use that passkey to log in and take over the account. This bypasses all existing passwords and multi-factor authentication protections.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-105212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105212 being exploited in the wild.

**How severe is CVE-2026-105212?** High severity, with a CVSS score of 7.5, published 4 October 2026.

**Which products and versions are affected?** ZITADEL 3.0.0 to 3.4.13, 4.0.0 to 4.16.1.

**Is there a fix for CVE-2026-105212?** Yes: fixed in ZITADEL 3.4.14, 4.16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105212 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105212?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZITADEL 3.4.14, 4.16.2

## Technical details

ZITADEL's hosted Login V1 and Login V2 UIs accept authenticator (passkey) enrollment on identify-only login sessions—after a username is submitted but before primary factor verification. An unauthenticated attacker knowing only a valid username can enroll an attacker-controlled authenticator and complete login, circumventing password and MFA requirements. The vulnerability stems from missing authentication checks before allowing authenticator enrollment within the login flow.

## Affected products

- ZITADEL ZITADEL 3.0.0 to 3.4.13, 4.0.0 to 4.16.1

## Timeline

- 2026-07-29: disclosed
- 2026-10-04: advisory

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-45f2-5q3r-xgg6](https://github.com/zitadel/zitadel/security/advisories/GHSA-45f2-5q3r-xgg6)
- [https://www.vulncheck.com/advisories/zitadel-before-3.4.14-and-4.16.2-account-takeover-via-passkey-enrollment](https://www.vulncheck.com/advisories/zitadel-before-3.4.14-and-4.16.2-account-takeover-via-passkey-enrollment)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)