CVE-2026-105215

Published 4 October 2026 · tracked since 4 October 2026

Description

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConf

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105217 LOW 3.1
• CVE-2026-105219 HIGH 7.5
• CVE-2026-105089 HIGH 8.7
• CVE-2026-105224 MEDIUM 5.4
• CVE-2026-105158 HIGH 7.3
• CVE-2026-105156 LOW 3.7
• CVE-2026-105146 MEDIUM 4.7
• CVE-2026-105144 MEDIUM 5.3
• CVE-2026-105137 MEDIUM 5
• CVE-2026-86817

→ Open the live CVE board · all tools