Is CVE-2026-105215 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105215?

CVE-2026-105215 has a CVSS v3 severity of CRITICAL (9.1).

Back

CVE-2026-105215

Description

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.