Advisory · CVE-2026-105209
ZITADEL checks the wrong org when handing out passkey setup codes
ZITADEL validates the organization from a request header instead of the target user's organization when issuing passkey enrollment codes, letting attackers from one org register authenticators on users in another org.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105209
CWE-862 - Action timing
- Immediate
Explain it like I’m five
When ZITADEL hands out a code to set up a new passkey, it checks which company the requester claims to belong to instead of which company the target user belongs to. An attacker in company A can ask for a setup code for someone in company B on the same server, then register their own fingerprint and take over the account.
- 01Foothold in another org
The attacker holds user-write permission in one organization on a shared ZITADEL instance.
- 02Enrollment code requested
The attacker requests a passkey or passwordless enrollment code for a user in a different organization; the check uses only the x-zitadel-orgid header.
- 03Attacker registers authenticator
With the code, the attacker registers their own authenticator on the victim's account.
- 04Account taken over
The attacker authenticates as the victim in the victim's organization.
What happened
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 has an improper authorization flaw: when issuing passkey or passwordless enrollment codes, it checks only the organization named in the x-zitadel-orgid header, not the target user’s organization. An attacker with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator, taking over that account. It is rated critical at CVSS 9.6 under CVSS v3.1 (9.3 under v4.0) and tracked as CWE-862.
What to do
- Upgrade ZITADEL to 4.17.1 or later, or to 3.4.15 or later on the 3.x line.
- Audit recently enrolled passkeys and passwordless authenticators, particularly cross-organization enrollments performed by users with user-write roles.
- Review audit logs for enrollment-code issuance where the header organization differs from the target user’s organization.
- Remove rogue authenticators and force re-verification for affected users.
Management note
Multi-tenant identity systems live or die by organization boundaries, and this flaw breaks the boundary from the inside. Any shared ZITADEL instance serving more than one organization should upgrade immediately and review enrollment records, because a quietly registered passkey is durable, phishing-resistant access in the attacker’s hands.