Skip to content
Threat Feed
Subscribe
low advisory

Zitadel User API Verification Code Disclosure Vulnerability

An improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.

Zitadel (CVE-2026-54693) contains a vulnerability within its User API that permits authenticated users to access verification codes for email addresses and phone numbers that do not belong to them. While a previous security advisory (CVE-2026-27946) addressed unauthorized setting of the is_verified flag, this secondary flaw allows users to retrieve the actual codes used for the verification workflow. By obtaining these codes, an attacker can bypass standard verification protocols for accounts or contact information they do not legitimately control. This vulnerability poses a significant risk to identity-based security policies that rely on verified email or phone ownership. The issue affects Zitadel versions 4.x (up to 4.15.0), 3.x (up to 3.4.10), and 2.x (2.43.0 through 2.71.19). Defenders should prioritize upgrading to the patched releases (4.15.1 or 3.4.11) to restore proper authorization controls.

Impact

The vulnerability allows unauthorized users to claim ownership of contact information, potentially bypassing security policies that mandate verified contact methods for account recovery, MFA, or communication. If exploited, an attacker could assume control of identity verification workflows, leading to unauthorized account access or the masking of identity in security logs. The scope is limited to Zitadel instances configured to allow user self-management of profile data.

Recommendation

  • Upgrade Zitadel installations to versions >= 4.15.1 or >= 3.4.11 immediately to enforce correct permission checks for verification code retrieval.
  • Audit existing user accounts for suspicious contact information updates or unauthorized verification states if the instance was exposed to the public.
  • Implement monitoring for excessive API calls to user-management endpoints (e.g., UpdateHumanUser or associated verification code endpoints) from non-administrative accounts.