ZITADEL’s login V2 user interface, available in versions 4.0.0 through 4.12.0, contains a flaw that lets users bypass the platform’s authentication and security policies. An attacker can self‑register new accounts or log in with a password even when the organization has disabled those options. The flaw falls under CWE‑287, an authentication bypass weakness, and can lead to unauthorized access to protected resources.

This vulnerability affects the ZITADEL identity‑management platform from vendors’ product line. All deployments of ZITADEL version 4.0.0 up to but not including 4.12.1 are exposed. The fix is delivered in ZITADEL 4.12.1 and later releases.

The vulnerability has a CVSS score of 8.2, indicating high severity, yet the EPSS score is reported as less than 1% and the issue is not listed in the CISA KEV catalog, suggesting a low probability of current exploitation. Attackers would most likely exploit the flaw via the web login interface, submitting crafted credentials or form data that the UI accepts even when the configuration forbids such actions.