Critical severity · published Oct 4, 2026
CVE-2026-105207
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
zitadel · zitadel
before 4.17.3; through 4.19.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105207
vendor-advisory
https://github.com/zitadel/zitadel/security/advisories/GHSA-g8gj-gq47-xgf4
third-party-advisory
https://www.vulncheck.com/advisories/zitadel-before-4.17.3-account-takeover-via-external-idp-linking
More from zitadel
9.8
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
9.8
CVE-2025-64103
Zitadel Bypass Second Authentication Factor
9.8
CVE-2025-64102
Zitadel allows brute-forcing authentication factors
9.6
CVE-2026-105209
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
9.3
CVE-2026-29067
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login