Act nowDisclosed

Advisory · CVE-2026-105207

ZITADEL lets attackers bind their own identity login to your account

Unauthenticated attackers who know a victim's login name can link their own external identity provider account to the victim's ZITADEL user and sign in as them, with no primary-factor check.

Advisory published October 4, 2026Independent summary
Vendor
ZITADEL
Product
ZITADEL
Identifier / CWE
CVE-2026-105207
CWE-306
Action timing
Immediate
ELI5

Explain it like I’m five

ZITADEL lets you connect an outside login, like Google, to your account without first checking that you are really you. An attacker who knows your username can connect their own outside login to your account and walk in through your front door.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Identify-only session

    The attacker starts a login flow for the victim's account name, reaching an identify-only session where no primary factor has been verified.

  2. 02Attacker's IdP linked

    Through the Login V2 flow or the User Service V2 AddIDPLink endpoint, the attacker links their own external identity provider account to the victim's user, with no permission or primary-factor check.

  3. 03Sign in as victim

    The attacker authenticates with their own external identity provider and is signed in as the victim's ZITADEL user.

What happened

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller’s permission. The flaw is reachable on identify-only Login V2 sessions and through the User Service V2 AddIDPLink endpoint. An unauthenticated attacker who knows a victim’s login name can bind their own external IdP identity to the victim’s account and then sign in as the victim. It is rated critical at CVSS 9.8 under CVSS v3.1 (9.3 under v4.0) and tracked as CWE-306.

What to do

  1. Upgrade ZITADEL to 4.17.3 or later (the vendor security advisory marks 4.17.3 as the fixed 4.x release; the 3.x line is affected through 3.4.15).
  2. Audit existing external identity provider links on user accounts for linkages users did not create, especially links added around account provisioning or migration windows.
  3. Review login and identity-link audit logs for AddIDPLink calls and external login bindings originating from identify-only sessions.
  4. If unexpected links are found, remove them and force credential and session resets for the affected accounts.

Management note

This is an unauthenticated, full account-takeover path in an identity provider, the one component that is supposed to guarantee who is who. Any environment using ZITADEL as its customer or workforce identity source should treat the upgrade as urgent and pair it with a review of identity-link records, because a silently linked external account is persistent access that survives password resets.