ZITADEL’s passkey registration endpoints perform an improper expiration check on registration codes. When an expired or previously retrieved code is reused, the system accepts it and registers the supplied passkey. This flaw allows an attacker to add a new credential to a victim’s account, effectively granting the attacker authentication rights for that account.

The vulnerability affects the Zitadel identity management platform (vendor zitadel:zitadel) in all releases prior to version 3.4.8 and 4.12.2. Any deployment using these older versions is susceptible until the patches in the indicated releases are applied.

The CVSS v3 score of 7.4 indicates high severity. The EPSS score is reported as less than 1 %, implying a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is remote via the web API, specifically through the passkey registration endpoint. An attacker who obtains or reuses an expired registration code can submit it to the endpoint, bypass the expiration check, and register a new passkey, thereby gaining access to the victim’s account.