CVE-2026-105215
Critical · 9.1CVSS
9.1
EPSS
0.3%
Published
Oct 4, 2026
CISA due date
—
The record
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-290
- CVE-2026-104623 A security vulnerability exists in the authorization handling for the local (management)… CWE-290
- CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in… CWE-290
- CVE-2026-104615 A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration… CWE-290
- CVE-2026-91914 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by… CWE-290
- CVE-2026-119425 OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in… CWE-290
- CVE-2026-115962 Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity… CWE-290
- CVE-2026-118653 Echo is a Go web framework. CWE-290