Summary
A critical improper authorization vulnerability in ZITADEL can allow enrollment codes for passkeys or passwordless authentication to be issued for users belonging to another organization. An attacker with user-write permission in one organization may use the code to register an authenticator and take over a targeted account on the same instance.
Affected context
The issue can arise in multi-organization ZITADEL instances when passkey or passwordless enrollment requests rely on the organization identified by the x-zitadel-orgid header without independently confirming that the target user belongs to that organization. Deployments are most exposed when users have permission to create or modify accounts and organization boundaries share the same identity service.
Exploit preconditions
- Attack surface: Passkey or passwordless enrollment workflows
- Required access: User-write permission in an organization on the affected ZITADEL instance
- Target condition: A user account belonging to a different organization on the same instance
- Trigger point: Issuance and use of an enrollment code for the target account
- Why exploitation is possible: Authorization is based on the organization supplied in the request header rather than being verified against the target user's actual organization
Why this happens
The vulnerability results from an incomplete authorization check in a cross-organization identity workflow. The application trusts a caller-controlled organization context while failing to verify that the target user is within that same authorization boundary. This maps to CWE-862: Missing Authorization, because a sensitive account-management operation can proceed without validating authorization for the specific target resource.
Potential impact
- An attacker may register their own authenticator for another organization's user
- The targeted account could be taken over
- Attackers could gain access to protected applications and data
- Cross-organization isolation could be weakened
- Compromised accounts could be used for privilege escalation or further intrusion
General mitigation guidance
Mitigation generally focuses on enforcing resource-level authorization throughout enrollment workflows.
Common defensive patterns include:
- Deriving the target user's organization from trusted server-side identity data
- Verifying that the requester, organization context, and target user belong to the same permitted security boundary
- Applying authorization checks immediately before issuing and consuming enrollment codes
- Binding enrollment codes to the intended user, organization, and operation
- Limiting user-management permissions according to least privilege
- Avoiding reliance on caller-controlled headers for tenant isolation
- Requiring strong reauthentication or administrative approval for sensitive authenticator enrollment
How teams detect issues like this
Organizations can look for:
- Static analysis and code review rules that flag authorization decisions based only on request headers or tenant identifiers
- Review signals where target-resource ownership is not checked during account or authenticator enrollment
- Audit events showing enrollment codes issued across organization boundaries
- Requests in which the organization context differs from the target user's recorded organization
- Policy enforcement requiring server-side tenant validation for all identity-management operations
Automated security review tools may help identify missing object-level authorization checks and unsafe trust in client-supplied tenancy information.
