Unauthenticated Second-Factor Enrollment in ZITADEL Login

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ZITADEL, an open-source identity and access management platform, contains a critical authentication bypass in versions 3.x before 3.4.15 and 4.x before 4.17.1. The vulnerability exists in the hosted Login V1 UI where second-factor enrollment and initialization handlers process requests on identify-only sessions—before any primary authentication factor has been verified. This means an attacker who knows only a victim's username can enroll their own TOTP, OTP-SMS, OTP-Email, or U2F factors, effectively locking the legitimate user out or enabling account takeover. Additionally, attackers can overwrite verified phone numbers and enumerate valid usernames through error message discrepancies. Organizations running vulnerable ZITADEL instances face immediate risk of unauthorized account access, especially in environments where MFA is relied upon as a primary security control.

Casky's 283 matched skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across the Initial Access (TA0004) and Credential Access (TA0006) MITRE ATT&CK tactics. A practitioner using Casky would identify suspicious patterns including: unauthenticated POST requests to MFA enrollment endpoints, factor registration occurring before primary authentication completion, rapid sequential enrollment attempts across multiple factor types from a single source, and authentication error responses that leak valid username information. The platform's skill set would surface these behaviors through session analysis, request sequencing anomalies, and deviation from expected authentication workflows—enabling defenders to spot reconnaissance attempts (user enumeration) and account compromise activities before legitimate credentials are fully compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105210.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-105210

Casky has 283 skills that investigate the attack patterns behind CVE-2026-105210. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn