Cross-Organization Passkey Enrollment Code Authorization Bypass

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ZITADEL 3.x and 4.x contain a critical authorization flaw in passkey and passwordless enrollment code generation. The vulnerability stems from insufficient organization validation—the system checks only the organization ID in the request header rather than verifying the target user actually belongs to that organization. An attacker with user-write permissions in one organization can exploit this to generate enrollment codes for users in completely different organizations on the same instance, then register their own authenticators to achieve full account takeover. This affects any multi-tenant ZITADEL deployment and is particularly dangerous because it requires only moderate privileges (user-write) to escalate to complete identity compromise.

Casky's 283 matched skills help practitioners detect this attack pattern by mapping it across MITRE's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Claude's extended reasoning analyzes suspicious enrollment code issuance patterns—specifically, detecting when codes are requested for users outside the requesting user's organization, or when legitimate users receive unexpected authenticator registration prompts. Practitioners using Casky would observe findings showing: anomalous cross-organization API calls to enrollment endpoints, mismatched organization contexts in request/user pairs, successful authenticator registrations from unexpected sources, and session takeovers following enrollment code abuse. The platform's skill-based detection correlates these signals to surface the authorization bypass before account compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105209.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-105209

Casky has 283 skills that investigate the attack patterns behind CVE-2026-105209. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn