CVE-2026-105209 Overview
CVE-2026-105209 is an improper authorization vulnerability in ZITADEL, an open-source identity and access management platform. The flaw affects the passkey and passwordless enrollment code issuance workflow. ZITADEL validates only the organization specified in the x-zitadel-orgid header rather than the organization of the target user. An attacker with user-write permissions in one organization can request an enrollment code for a user belonging to a different organization on the same instance. The attacker then registers an authenticator under the victim's account, achieving full account takeover across tenant boundaries.
Critical Impact
Cross-tenant account takeover on shared ZITADEL instances, enabling attackers with limited privileges in one organization to seize accounts, including administrative identities, in any other organization on the same instance.
Affected Products
- ZITADEL 3.x versions prior to 3.4.15
- ZITADEL 4.x versions prior to 4.17.1
- Multi-tenant ZITADEL instances hosting multiple organizations
Discovery Timeline
- 2026-10-04 - CVE-2026-105209 published to NVD
- 2026-10-05 - Last updated in NVD database
Technical Details for CVE-2026-105209
Vulnerability Analysis
ZITADEL exposes application programming interfaces (APIs) that issue enrollment codes for passkey and passwordless authenticator registration. The affected endpoints trust the x-zitadel-orgid HTTP header to determine the authorization scope. The server verifies the caller's write permissions against the organization identified in that header, not the organization that owns the target user.
This authorization gap allows an authenticated principal with the user.write permission in Organization A to call the enrollment endpoint while targeting a user in Organization B. ZITADEL issues a valid enrollment code bound to the victim user, which the attacker uses to register an attacker-controlled authenticator. Subsequent passwordless logins succeed as the victim identity. The vulnerability is tracked under CWE-862: Missing Authorization.
Root Cause
The root cause is a mismatched authorization check. Permission validation uses the caller-controlled org header as the authority context instead of resolving the target user's actual owning organization and enforcing the check against that resource. Any multi-tenant instance that grants user.write in any organization becomes a lateral entry point into every other organization on the instance.
Attack Vector
Exploitation requires network access to the ZITADEL API and valid credentials for a principal holding user-write privileges in at least one organization on the target instance. The attacker sets the x-zitadel-orgid header to their own organization, specifies the victim user identifier from a different organization in the request body, and receives a valid passkey enrollment code. Registering a WebAuthn authenticator against that code completes the takeover. No user interaction from the victim is required.
No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-pq2q-2c6r-75c4 and the VulnCheck Advisory for Zitadel.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105209
Indicators of Compromise
- Passkey or passwordless enrollment API calls where the x-zitadel-orgid header value differs from the owning organization of the target user identifier.
- New WebAuthn authenticator registrations on user accounts that did not initiate a self-service enrollment request.
- Passwordless login success events from previously unseen devices, geolocations, or user agents shortly after an enrollment event.
Detection Strategies
- Correlate ZITADEL audit logs for user.human.passwordless.code.added and user.human.passkey.code.added events against the organization ownership of the referenced user.
- Alert when the request-scoped org identifier does not match the stored organization of the user being modified.
- Baseline normal enrollment volume per administrative principal and flag spikes or off-hours activity.
Monitoring Recommendations
- Forward ZITADEL audit and admin API logs to a centralized analytics platform for cross-tenant correlation.
- Monitor for subsequent authentication from newly registered authenticators and tie them back to the enrollment request origin.
- Review all principals granted user.write or equivalent roles and audit their recent enrollment-related API activity.
How to Mitigate CVE-2026-105209
Immediate Actions Required
- Upgrade ZITADEL 3.x instances to version 3.4.15 or later.
- Upgrade ZITADEL 4.x instances to version 4.17.1 or later.
- Audit recent passkey and passwordless enrollment events for cross-organization header mismatches and revoke suspicious authenticators.
- Rotate sessions and force re-authentication for users whose accounts show unexpected authenticator registrations.
Patch Information
The ZITADEL maintainers released fixes in versions 3.4.15 and 4.17.1. The patch adds authorization checks against the target user's owning organization rather than trusting the x-zitadel-orgid header. Full remediation details are published in the GitHub Security Advisory GHSA-pq2q-2c6r-75c4.
Workarounds
- Restrict the user.write permission to a minimal set of trusted administrators until patching is complete.
- Segment high-value organizations onto dedicated ZITADEL instances to eliminate shared-tenant exposure.
- Place a reverse proxy or API gateway in front of ZITADEL to log and alert on enrollment API calls where the request-scoped org header diverges from the target user organization.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
