Unverified Identity Provider Account Linking in ZITADEL

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 suffer from a critical authentication bypass vulnerability (CVE-2026-105207, CVSS 9.8) stemming from insufficient verification during external identity provider linkage. The flaw allows unauthenticated attackers to link their own external IdP credentials to victim accounts by simply knowing the victim's login name, then authenticate as that victim. This affects organizations relying on ZITADEL for identity and access management, particularly those using federated authentication or multi-provider login scenarios. The vulnerability is especially dangerous because it bypasses primary authentication factors and operates on identify-only sessions, meaning attackers can hijack accounts without triggering standard login protections.

Casky's 283 mapped skills detect the attack patterns behind this vulnerability by analyzing MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection patterns for: unauthorized account modification requests lacking proper authentication context, anomalous IdP linking operations from unauthenticated sessions, and cross-account permission violations during identity federation flows. Claude AI's extended reasoning identifies the logical flow of account compromise—specifically, the absence of primary factor verification (CWE-306: Missing Authentication for Critical Function) as the critical control failure. Security teams would see findings highlighting unverified identity binding attempts, suspicious session activity on identify-only endpoints, and unauthorized external IdP associations appearing in User Service V2 logs, enabling rapid identification and remediation of compromised accounts before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105207.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-105207

Casky has 283 skills that investigate the attack patterns behind CVE-2026-105207. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn