Organization Deactivation Bypass in ZITADEL Authentication

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-105213 represents a critical authentication bypass vulnerability in ZITADEL 4.x where deactivated organizations can still be accessed by users with valid credentials or existing sessions. The vulnerability stems from incomplete validation logic in the Login V2 authentication flow—while individual user status is checked, the organization's inactive state is overlooked. This allows attackers to maintain unauthorized access to disabled tenant environments, potentially compromising multi-tenant SaaS deployments, enterprise identity infrastructure, and sensitive organizational data. Any organization using ZITADEL 4.x before version 4.17.1 is at risk, particularly those relying on account suspension as a security control during offboarding, breach response, or organizational restructuring.

Casky's 283 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would identify suspicious authentication patterns: successful login attempts from users whose parent organization should be inactive, unexpected token generation for deactivated tenants, and session persistence after organizational suspension. The platform's skill-based detection would surface anomalies in authentication logs showing credential validation bypassing organizational controls, privilege maintenance post-deactivation, and refresh token abuse—enabling security teams to spot compromised accounts attempting to re-establish persistence in disabled environments before lateral movement or data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105213.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-105213

Casky has 283 skills that investigate the attack patterns behind CVE-2026-105213. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn