{"id":"CVE-2026-105207","published":"2026-10-04T15:16:31.677","lastModified":"2026-10-06T22:17:02.023","description":"ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-g8gj-gq47-xgf4","tags":[]},{"url":"https://www.vulncheck.com/advisories/zitadel-before-4.17.3-account-takeover-via-external-idp-linking","tags":[]}],"exploitRefs":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-g8gj-gq47-xgf4","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw allows unauthenticated attackers to bind their external identity provider accounts to victims' ZITADEL accounts, enabling them to impersonate victims. This is critical as it bypasses authentication and authorization controls.","exploitability":"Exploitation is relatively straightforward for an attacker who knows the victim's login name, as no primary factor verification or caller permission is required.","blast_radius":"If exploited, the attacker can fully compromise the victim's account, leading to potential data exfiltration, unauthorized actions, and further attacks.","remediation":"Upgrade to ZITADEL 3.4.16 or 4.17.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","identity-provider"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:42:22.621Z"}}