Summary
A missing authentication flaw in ZITADEL's hosted Login V1 UI allows second-factor enrollment and initialization actions to proceed after only an identify-only session has been established. An attacker who knows a victim's login name may register attacker-controlled factors, alter verified phone information, or infer user existence from different error responses.
Affected context
The issue occurs in ZITADEL deployments using the hosted Login V1 UI when second-factor enrollment or initialization handlers accept an identify-only session as sufficient authorization. The risk is present when these handlers do not require successful primary-factor verification before changing authentication factors or other verified identity attributes.
Exploit preconditions
- Attack surface: Hosted Login V1 second-factor enrollment and initialization handlers
- Required access: Knowledge of a victim's login name; no prior authenticated session may be required
- Trigger point: Requests that enroll or initialize TOTP, OTP-SMS, OTP-Email, or U2F factors, or update verified phone information
- Why exploitation is possible: The handlers act on an identify-only session before confirming that the primary authentication factor has been verified
Why this happens
The underlying bug is an authorization decision made using insufficient authentication state. An identify-only session establishes which account is being addressed, but it does not prove control of that account; treating it as authorized for factor enrollment or verified-attribute changes maps to CWE-287: Improper Authentication. Discrepant error handling may additionally disclose whether a supplied login name corresponds to a user.
Potential impact
- An attacker could enroll an attacker-controlled second factor
- An attacker could weaken or bypass subsequent authentication requirements
- An attacker could potentially obtain unauthorized account access
- Verified phone information could be overwritten or abused for account recovery flows
- User enumeration could expose account-registration information
- Authentication integrity and user trust could be reduced
General mitigation guidance
Mitigation generally focuses on binding sensitive account changes to a fully authenticated session and enforcing step-up verification at the authorization boundary.
Common defensive patterns include:
- Require successful primary-factor verification before enrollment, replacement, or removal of authentication factors
- Treat identify-only sessions as informational rather than authorized
- Require reauthentication or equivalent step-up controls for changes to verified contact attributes
- Apply consistent responses and timing to reduce user-enumeration signals
- Use narrowly scoped authorization checks for each factor-management operation
- Limit recovery and factor-management privileges according to least-privilege principles
- Add regression tests covering unauthenticated, identify-only, and fully authenticated states
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for sensitive handlers that accept identity context without authentication-state validation
- Review signals showing factor enrollment, recovery changes, or verified-attribute updates before primary authentication completes
- Authorization tests that exercise each endpoint across anonymous, identify-only, partially authenticated, and fully authenticated sessions
- Monitoring for repeated factor-enrollment attempts, unexpected factor replacement, and changes to verified phone attributes
- API and UI policy enforcement requiring step-up authentication for account-security changes
- Automated security testing or code-review tools that flag missing authentication checks and inconsistent error behavior
