Executive brief
ZITADEL, an identity management platform, contained a flaw that allowed users to verify their own email addresses or phone numbers without actually receiving a verification code. This could allow an attacker to claim ownership of contact information they do not control, potentially bypassing security policies that rely on verified identity. Organizations using ZITADEL for authentication should update to a patched version to ensure the integrity of user data.
Technical details
An incorrect authorization vulnerability (CWE-863) in ZITADEL's self-management API allowed authenticated users to retrieve their own email or phone verification codes. By exploiting improper permission checks, a user could update their profile and mark contact details as verified without completing the standard out-of-band verification flow. This bypasses security policies that depend on the 'is_verified' status of a user's email or phone. The issue is fixed in versions 4.15.1 and 3.4.11 (which also covers the 2.x branch). A workaround involves using ZITADEL Actions (v2) to block the API from returning verification codes to the user.
Affected products
- ZITADEL ZITADEL 2.43.0 to 2.71.19, 3.0.0 to 3.4.10, 4.0.0 to 4.15.0
Timeline
- 2026-06-08: disclosed
- 2026-07-29: advisory