CVE ID :CVE-2026-105207 Published : Oct. 4, 2026, 1:10 p.m. | 2 hours, 17 minutes ago Description :ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-105207 - ZITADEL before 4.17.3 Account Takeover via External IdP Linking

VERWANDTEARTIKEL

CVE-2026-105215 - ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

CVE-2026-105213 - ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

CVE-2026-105209 - ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

CVE-2026-105210 - ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

CVE-2026-105134 - Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

CVE-2026-105135 - InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection