A vulnerability in ZITADEL allows unauthenticated attackers to enroll an attacker‑controlled authenticator during an identify‑only login session. Because the system accepts passkey or other authenticator enrollment before any primary factor—such as a password or MFA—is verified, an attacker can register a passkey for a victim who is already known in the system and then log in as that victim without providing any primary credential. The weakness is an authentication bypass (CWE‑287) that grants an attacker full account access to the targeted user.

The affected products are ZITADEL releases 3.x prior to version 3.4.14 and 4.x prior to version 4.16.2. Any deployment of these versions that exposes the hosted Login V1 or Login V2 UIs is vulnerable.

The CVSS score is 8.7, classifying the issue as high severity and indicating significant impact if exploited. EPSS is not available, so the current exploitation probability is unknown, but the documented authentication bypass provides a clear attack path. The vulnerability is not listed in the CISA KEV catalog, yet the combination of a known authentication flaw and the ease of enrolling a passkey makes it a serious risk. The likely attack vector is an unauthenticated web attacker with knowledge of a victim’s login name, able to submit a passkey enrollment request and then use the newly registered authenticator to authenticate as that victim.