CVE-2026-105215: ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-04 · updated 2026-10-29
Weakness: CWE-290

Description

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.

Affected products

zitadel: from 4.0.0 before 4.16.2 — fixed in 4.16.2

How to fix

Upgrade to a fixed version: zitadel 4.16.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-105215 or the next vulnerability affects your stack