# CVE-2026-105215: ZITADEL authentication bypass in Login V1 UI

Source: https://junglewise.ai/threats/cve-2026-105215-zitadel-before-3-4-14-and-4-x-before-4-16-2-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105215 · Severity: critical · CVSS 9.1 · Published 2026-10-04

ZITADEL is an open-source identity and access management platform that handles user authentication. An attacker can forge external identity provider credentials to pre-create accounts bound to a victim's external identity, then hijack the victim's login when they authenticate normally. This allows account takeover without needing access to the victim's external identity provider account.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-105215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105215 being exploited in the wild.

**How severe is CVE-2026-105215?** Critical severity, with a CVSS score of 9.1, published 4 October 2026.

**Which products and versions are affected?** ZITADEL 3.0.0 through 3.4.13, 4.0.0 through 4.16.1.

**Is there a fix for CVE-2026-105215?** Yes: fixed in ZITADEL 3.4.14, 4.16.2. Until then: If immediate upgrade is not possible, disable "Account creation allowed (manually)" on each configured external IdP. This blocks the vulnerable registration path but disables legitimate self-service account creation via that IdP; automatic account creation after verified IdP callback is not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105215 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105215?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZITADEL 3.4.14, 4.16.2

If immediate upgrade is not possible, disable "Account creation allowed (manually)" on each configured external IdP. This blocks the vulnerable registration path but disables legitimate self-service account creation via that IdP; automatic account creation after verified IdP callback is not affected.

## Technical details

ZITADEL's Login V1 UI "external account not found" registration endpoint trusts client-supplied IDPConfigID and ExternalUserID values without requiring a completed IdP callback verification. An unauthenticated attacker can submit forged external identity fields to pre-create an account bound to any external IdP identity, which is then hijacked when a victim with that identity performs a genuine external login. Login V2 is unaffected as it uses cryptographically bound IdP intents.

## Affected products

- ZITADEL ZITADEL 3.0.0 through 3.4.13, 4.0.0 through 4.16.1

## Timeline

- 2026-07-29: disclosed: GitHub security advisory published
- 2026-10-04: advisory: Public disclosure via NVD

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-738m-7888-jfv8](https://github.com/zitadel/zitadel/security/advisories/GHSA-738m-7888-jfv8)
- [https://www.vulncheck.com/advisories/zitadel-before-4.16.2-account-pre-hijacking-via-forged-external-idp-callback](https://www.vulncheck.com/advisories/zitadel-before-4.16.2-account-pre-hijacking-via-forged-external-idp-callback)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)