CyberRota Analysis
AI-GeneratedZITADEL versions 3.x prior to 3.4.15 and 4.x prior to 4.17.1 are vulnerable due to an improper authorization flaw that allows attackers with user-write permissions to generate enrollment codes for users in different organizations on the same instance. This critical vulnerability can lead to account takeover by enabling unauthorized registration of authenticators. Organizations using these versions should prioritize patching to mitigate the risk of unauthorized access and account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.