Skip to content
Threat Feed
Subscribe

Product

ZITADEL (3.x < 3.4.15)

1 brief RSS
critical advisory

Authentication Bypass in ZITADEL Identity Provider

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 are vulnerable to an authentication bypass via the AddIDPLink endpoint, allowing unauthenticated attackers to link malicious external IdP identities to victim accounts.

ZITADEL +6 authentication-bypass cve-2026-105207 identity-management web-application vulnerability cve-2026-105213 cloud
6t 1c