CVE-2026-54693: Authorization Bypass in ZITADEL Identity Management Platform
Vulnerability ID: CVE-2026-54693
CVSS Score: 8.2
Published: 2026-07-29
A critical authorization bypass vulnerability was identified in the ZITADEL identity management platform, tracked as CVE-2026-54693 (GHSA-jq8w-8q2f-ffm9). Due to incorrect privilege validation in self-service profile modification endpoints, standard authenticated users could obtain plaintext verification codes during email or phone number updates. This allows attackers to claim and verify arbitrary email addresses or phone numbers without controlling the underlying contact methods.
TL;DR
ZITADEL allowed self-managing users to request plaintext verification OTPs in API responses by setting the returnCode parameter to true. Standard users could exploit this logic flaw to verify arbitrary email addresses and phone numbers without possessing actual access to the targeted out-of-band communication channel.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-863
- Attack Vector: Network
- CVSS Score: 8.2 (High)
- Exploit Status: PoC
- CISA KEV Status: Not Listed
Affected Systems
- ZITADEL Identity Platform
-
ZITADEL: >= 2.43.0, < 2.71.19 (Fixed in:
2.71.19) -
ZITADEL: >= 3.0.0-rc.1, < 3.4.11 (Fixed in:
3.4.11) -
ZITADEL: >= 4.0.0-rc.1, < 4.15.1 (Fixed in:
4.15.1)
Code Analysis
Commit: 90f3102
Fix authorization bypass on email changes
Commit: a1748b2
Fix authorization bypass on phone changes
Commit: ed09b3d
Fix authorization bypass on human profile updates
Mitigation Strategies
- Upgrade to a patched version of ZITADEL (v3.4.11 or v4.15.1).
- Monitor API gateway logs for unauthorized use of the returnCode parameter in self-service endpoints.
- Audit existing database and event store entries for anomalies in verification speeds.
Remediation Steps:
- Identify the current running ZITADEL version and branch.
- Apply the update to version 3.4.11 (for v3) or 4.15.1 (for v4).
- Review the event store for suspicious patterns where email changes and email verifications occur within consecutive seconds.
References
- ZITADEL Security Advisory GHSA-jq8w-8q2f-ffm9
- ZITADEL Release v3.4.11
- ZITADEL Release v4.15.1
- CVE-2026-54693 Record
Read the full report for CVE-2026-54693 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)