Is CVE-2026-105215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105215 being exploited in the wild.

How severe is CVE-2026-105215?

Critical severity, with a CVSS score of 9.1, published 4 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 through 3.4.13, 4.0.0 through 4.16.1.

How is CVE-2026-105215 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105215?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105215: ZITADEL authentication bypass in Login V1 UI

CVE-2026-105215 · Severity: critical · CVSS 9.1 · Published 2026-10-04

ZITADEL is an open-source identity and access management platform that handles user authentication. An attacker can forge external identity provider credentials to pre-create accounts bound to a victim's external identity, then hijack the victim's login when they authenticate normally. This allows account takeover without needing access to the victim's external identity provider account.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-105215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105215 being exploited in the wild.
How severe is CVE-2026-105215?: Critical severity, with a CVSS score of 9.1, published 4 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 through 3.4.13, 4.0.0 through 4.16.1.
Is there a fix for CVE-2026-105215?: Yes: fixed in ZITADEL 3.4.14, 4.16.2. Until then: If immediate upgrade is not possible, disable "Account creation allowed (manually)" on each configured external IdP. This blocks the vulnerable registration path but disables legitimate self-service account creation via that IdP; automatic account creation after verified IdP callback is not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105215 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105215?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ZITADEL 3.4.14, 4.16.2

If immediate upgrade is not possible, disable "Account creation allowed (manually)" on each configured external IdP. This blocks the vulnerable registration path but disables legitimate self-service account creation via that IdP; automatic account creation after verified IdP callback is not affected.

Technical details

ZITADEL's Login V1 UI "external account not found" registration endpoint trusts client-supplied IDPConfigID and ExternalUserID values without requiring a completed IdP callback verification. An unauthenticated attacker can submit forged external identity fields to pre-create an account bound to any external IdP identity, which is then hijacked when a victim with that identity performs a genuine external login. Login V2 is unaffected as it uses cryptographically bound IdP intents.

Affected products

ZITADEL ZITADEL 3.0.0 through 3.4.13, 4.0.0 through 4.16.1

Timeline

2026-07-29: disclosed: GitHub security advisory published
2026-10-04: advisory: Public disclosure via NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.