Summary
ZITADEL's hosted Login V1 and Login V2 interfaces may allow an attacker to enroll a passkey or other authenticator during an identify-only login session, before the user's primary factor is verified. An unauthenticated attacker who knows a victim's login name could then authenticate as that user, bypassing existing passwords and multi-factor authentication.
Affected context
The vulnerability occurs in ZITADEL deployments using the affected hosted Login V1 or Login V2 user interfaces when authenticator enrollment is available before primary-factor verification. The issue is relevant where a login session can be initiated using only a known login name and the enrollment flow does not require proof of control over an already trusted authentication factor.
Exploit preconditions
- Attack surface: Hosted ZITADEL Login V1 or Login V2 authentication interfaces
- Required access: No authenticated access; knowledge of the victim's login name may be sufficient
- Trigger point: Passkey or other authenticator enrollment during an identify-only login session
- Why exploitation is possible: The enrollment operation is permitted before verification of an existing primary factor, allowing an attacker-controlled authenticator to become associated with the victim's account
Why this happens
The underlying flaw is an authentication state-management error in which account identification is treated as sufficient authority to enroll a new authenticator. This violates the separation between identifying an account and proving control of that account's existing credentials. The behavior maps to CWE-287: Improper Authentication, because a security-sensitive authentication step can be completed without validating an appropriate primary authentication factor.
Potential impact
- An attacker could take over a targeted user account
- Existing passwords and MFA protections could be bypassed
- Unauthorized access to applications and data could occur
- Account-level actions, changes, or impersonation could be performed
- Compromised accounts could be used for privilege escalation or lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing authentication-state boundaries and requiring proof of account control before enrollment.
Common defensive patterns include:
- Require successful verification of an existing primary factor before registering any new authenticator
- Treat identify-only sessions as insufficient for credential or MFA enrollment
- Bind enrollment operations to an explicitly authenticated session with an appropriate assurance level
- Require reauthentication or step-up verification for security-sensitive account changes
- Apply least privilege and limit the impact of accounts that can manage authentication settings
- Monitor and notify on new authenticator registration, recovery changes, and other credential lifecycle events
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Code review of authentication state transitions and enrollment authorization checks
- Static analysis and test rules that flag credential enrollment reachable from unauthenticated or identify-only states
- Integration tests verifying that new authenticators cannot be added without proof of an existing factor
- Policy enforcement requiring step-up authentication for MFA, passkey, and recovery-method changes
- Audit-log monitoring for authenticator registrations followed by unusual sign-ins or account changes
Automated security review tools may help identify inconsistent authorization checks across login flows.
