Advisory · CVE-2026-105212
ZITADEL accepts passkey enrollment before the password is checked
ZITADEL's hosted Login V1 and V2 UIs allow passkey or authenticator enrollment on identify-only sessions before any primary factor is verified, so unauthenticated attackers can register their own authenticator and log in as the victim.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105212
CWE-287 - Action timing
- Immediate
Explain it like I’m five
Imagine a bank that lets you order a new keycard for someone's account just by saying their name, before you prove you are them. An attacker says your username, registers their own passkey on your account, and walks in, and your real password no longer matters.
- 01Identify-only session
The unauthenticated attacker provides only the victim's login name, creating an identify-only session.
- 02Enrollment accepted
The Login V1 or V2 UI accepts passkey or other authenticator enrollment on that session, before any primary factor is verified.
- 03Attacker's authenticator registered
The attacker registers an authenticator only they control.
- 04Login as victim
The attacker logs in as the victim, bypassing the existing password and MFA.
What happened
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs: passkey or other authenticator enrollment is accepted on identify-only login sessions before any primary factor is verified. Unauthenticated attackers knowing only a victim’s login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA. It is rated high at CVSS 8.7 under CVSS v4.0 (7.5 under v3.1) and tracked as CWE-287.
What to do
- Upgrade ZITADEL to 4.16.2 or later, or to 3.4.14 or later on the 3.x line.
- Audit authenticator enrollments for devices and passkeys users did not register, prioritizing administrator accounts.
- Review login logs for enrollment events tied to sessions that never completed a primary factor.
- Remove rogue authenticators and have affected users re-enroll through a verified session.
Management note
Passkeys are marketed as phishing-resistant, and they are, right up until the enrollment itself accepts an unauthenticated stranger. This turns the strongest credential type into an attacker-controlled backdoor. Like its sibling flaws in this batch, the remedy pairs a fast upgrade with a review of the authenticator inventory.