NVD CRITICAL: CVE-2026-105215 — ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in...

Sunday, October 4, 2026 at 03:16 PM UTC·Source: NIST NVD

Updated: Sunday, October 4, 2026 at 04:00 PM UTC

Executive Summary

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, w

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-105215

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 4, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Personio acquires spend management platform Circula

German unicorn Personio has purchased fellow German fintech Circula, one of Europe's largest spend management platforms.

57m agoFinextra

MEDIUMVulnerabilityPOC

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in

1h agoThe Hacker News

MEDIUMVulnerability

ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise

ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake breach

1h agoInfosecurity Magazine