CVE-2026-110796
ZITADEL Authentication Bypass via Improper Authenticator Enrollment
Description
### Summary ZITADEL’s hosted login UIs allowed an unauthenticated attacker who knows only a victim’s login name to register an attacker-controlled passkey (or other authenticator) on the victim’s account, then complete login as that user. Enrollment was accepted on an identify-only login session/request—after the username was submitted, but before any password or other primary factor was verified. ### Impact An attacker who knows a valid login name can take over the corresponding account without knowing the password, using an existing passkey, completing MFA, or interacting with the victim. This affects applications that authenticate users through ZITADEL’s hosted **Login V2** and/or legacy **Login V1** UI (OIDC/SAML). Existing passwords or second factors on the account do not prevent enrollment of the additional attacker-controlled authenticator. Legitimate passkey registration via emailed init/registration codes is unaffected in intent; the vulnerability was that login flows accepted enrollment without that proof of possession (or a prior authentication). ### Affected Versions Systems running one of the following versions are affected: * **4.x:** `4.0.0` through `4.16.1` (including RC versions) * **3.x:** `3.0.0` through `3.4.13` (including RC versions) ### Patches The vulnerability has been addressed in the latest releases. Login V2 now requires a verified primary factor (or a legitimate onboarding/user-verification path) before authenticator enrollment. Login V1 no longer allows passwordless setup from an auth request and only accepts the emailed init-code registration path. * **4.x**: Upgrade to $\ge$ [4.16.2](https://github.com/zitadel/zitadel/releases/tag/v4.16.2) * **3.x**: Upgrade to $\ge$ [3.4.14](https://github.com/zitadel/zitadel/releases/tag/v3.4.14) ### Workarounds The recommended solution is to upgrade to a patched version. There is no configuration that fully closes this gap on unpatched versions. ### Questions If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected]) ### Credits Thanks to: - Michael Wollner from Deutsche Telekom AG ([@Ibonok](https://github.com/Ibonok)) for reporting the Login V2 issue - Lucas Dodgson from InfoGuard Labs ([@lucasdodgson](https://github.com/lucasdodgson)) for independently reporting the Login V1 and Login V2 issues - [Dor Konis](http://github.com/dkonis), [Feras Daragma](http://github.com/FerasTr) and [Peleg Wasserman](http://github.com/pelegw) from GE Vernova - Adam Korczynski from Ada Logics ([@AdamKorcz](https://github.com/AdamKorcz)) for reporting the Login V2 issue with the help of Anthropic
INFO
Published Date :
July 29, 2026, 8:36 a.m.
Last Modified :
Oct. 15, 2026, 1:42 p.m.
Remotely Exploit :
No
Source :
github-security-advisories
Solution
- Upgrade ZITADEL to version 4.16.2 or later.
- Upgrade ZITADEL to version 3.4.14 or later.
- Ensure primary factor verification before authenticator enrollment.
- Use emailed init-code for authenticator registration.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-110796.
| URL | Resource |
|---|---|
| https://github.com/zitadel/zitadel/security/advisories/GHSA-45f2-5q3r-xgg6 | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-110796 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-110796 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-110796
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-110796 vulnerability anywhere in the article.