https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 14:25:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-105212 <p>ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim&#39;s login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.</p> <p>ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim&#39;s login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-105212 https://vulnerability.circl.lu/vuln/ghsa-4727-2r9w-rpch <p>ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim&#39;s login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.</p> <p>ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim&#39;s login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.</p> https://vulnerability.circl.lu/vuln/ghsa-4727-2r9w-rpch