Advisory · CVE-2026-105210
ZITADEL lets anyone enroll MFA factors on your account before login
ZITADEL's hosted Login V1 UI processes second-factor enrollment on identify-only sessions before any primary factor is verified, letting attackers enroll their own TOTP, SMS, or U2F factors on victim accounts.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105210
CWE-287 - Action timing
- Immediate
Explain it like I’m five
ZITADEL's old login page lets you add a second lock to an account before checking you own the first lock. An attacker who knows only your username can attach their own second lock to your account, overwrite your phone number, and then log in as you with both locks they control.
- 01Identify-only session
The attacker enters only the victim's login name, reaching an identify-only session with no primary factor verified.
- 02Enrollment handlers run
The second-factor enrollment and initialization handlers accept requests against that session.
- 03Attacker's factors enrolled
The attacker enrolls attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors and overwrites the verified phone number.
- 04Victim locked out, attacker in
The attacker authenticates as the victim; discrepant error messages can also be used to enumerate valid users.
What happened
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 has a missing-authentication flaw in the hosted Login V1 UI: second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim’s login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors. It is rated high at CVSS 8.8 under CVSS v4.0 (8.2 under v3.1) and tracked as CWE-287.
What to do
- Upgrade ZITADEL to 4.17.1 or later, or to 3.4.15 or later on the 3.x line.
- Audit MFA factor enrollments and verified phone number changes, especially ones not initiated by the account owner.
- Review logs for enrollment requests originating from identify-only sessions.
- Remove rogue factors and have affected users re-enroll through a verified session.
Management note
MFA is supposed to be the second lock that saves you when the password fails; here the attacker gets to install their own second lock before the first one is even checked. This is a full account-takeover primitive against any account the attacker can name, and it also hands out user enumeration. Upgrade promptly and treat recent factor enrollments as untrusted until reviewed.