Reported by 2 outlets
ZITADEL Cluster: 7 CVEs Including Critical Passkey Forgery
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.21 / 0.6 · time to second source
- Recency
- × 0.01 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
The ZITADEL cluster includes seven CVEs with a peak CVSS of 9.3. CVE-2026-105209 allows an attacker to forge the x-zitadel-orgid header, which leads to passkey enrollment for any user in any organization. Additional CVEs in the cluster cover related authentication and authorization weaknesses.
The events reference a threat analysis article and Mastodon updates but do not list each CVE with full descriptions in the event content. The critical passkey forgery is the headline risk; organizations using ZITADEL should review the vendor advisory for patches covering all seven tracked issues.
Timeline
-
original reporting
ZITADEL cluster — 7 CVEs, peak CVSS 9.3 CVE-2026-105209: forge x-zitadel-orgid header → issue passkey enrollment for any user in any org → f
threataft.com · 8d ago · October 5th, 2026
ZITADEL cluster — 7 CVEs, peak CVSS 9.3 CVE-2026-105209: forge x-zitadel-orgid header → issue passkey enrollment for any user in any org → f
via Mastodon https://threataft.com/articles/zitadel-cluster-cve-2026-105209-105215-105211-105208-105206-105210-105213
-
update from beyondmachines.net
ZITADEL Authentication Bypass Cluster Exposes Self-Hosted Identity Providers ZITADEL reports ten vulnerabilities, including seven critical f
beyondmachines.net · 7d ago · October 6th, 2026
ZITADEL Authentication Bypass Cluster Exposes Self-Hosted Identity Providers ZITADEL reports ten vulnerabilities, including seven critical f
via Mastodon https://beyondmachines.net/event_details/zitadel-authentication-bypass-cluster-exposes-self-hosted-identity-providers-x-y-t-u-q/gD2P6Ple2L