Advisory · CVE-2026-105215
ZITADEL's old login page lets attackers pre-hijack accounts
ZITADEL's hosted Login V1 UI trusts attacker-supplied external identity fields before any IdP callback completes, letting unauthenticated attackers pre-create accounts bound to a victim's external identity.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105215
CWE-290 - Action timing
- Immediate
Explain it like I’m five
ZITADEL's old login page takes your word for which outside identity you claim to be, before that identity is actually checked. An attacker pre-registers a fake account stamped with the victim's identity details; when the victim later logs in for real through the real identity provider, they land inside the attacker's trap account.
- 01Forged identity fields
The unauthenticated attacker submits forged IDPConfigID and ExternalUserID values to the 'external account not found' registration endpoint.
- 02Account pre-created
The endpoint trusts the client-supplied fields without a completed IdP callback and binds a new account to the victim's external IdP identity.
- 03Victim logs in
The victim's later genuine external login is matched to the pre-created account.
- 04Trap account entered
The victim signs into an account the attacker already controls.
What happened
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI: the “external account not found” registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim’s external IdP identity, which the victim’s later genuine external login then signs into. It is rated critical at CVSS 9.3 under CVSS v4.0 (9.1 under v3.1) and tracked as CWE-290.
What to do
- Upgrade ZITADEL to 4.16.2 or later, or to 3.4.14 or later on the 3.x line.
- Audit externally-registered accounts created recently for identities whose IdP linkage was never completed through a real callback.
- Review login logs for external-account registrations with mismatched or forged identity configuration IDs.
- Disable and re-provision suspicious accounts, and notify affected users to re-register through a verified flow.
Management note
Pre-hijacking is one of the nastiest account-takeover shapes because the victim does everything right and still ends up in the attacker’s account. If ZITADEL’s hosted Login V1 is exposed, this deserves a fast upgrade and a sweep of externally-created accounts, since the attack leaves almost no trace once the victim starts using the trap account normally.