ZITADEL Unauthenticated IdP Binding Leads to Account Takeover

Three CVSS 9.3 ZITADEL vulnerabilities enable account takeover, account forgery, and cross-organization takeover via IdP flaws.

2026-10-04 18:06 UTC

🔓 CVEs & KEV

CVE-2026-105207 — zitadel — CVSS 9.3 — ZITADEL Unauthenticated IdP Binding Leads to Account Takeover
CVE-2026-105215 — zitadel — CVSS 9.3 — ZITADEL IdP Authentication Bypass Leads to Account Forgery
CVE-2026-105209 — zitadel — CVSS 9.3 — ZITADEL Improper Authorization Enables Cross-Organization Account Takeover

Start with the free Posture Self-Check to see where you stand against the current threat landscape.