CVE-2026-105209: Critical ZITADEL Cross-Organization Passkey Takeover — Detection and Remediation Guide

---
title: ZITADEL Passkey or Passwordless Enrollment Code Issuance Burst by Single Principal
id: 3f7a2c91-4b6e-4d85-9a1c-8e2f5b7d0a43
status: experimental
description: Detects a single authenticated principal (admin or service account) issuing an abnormal volume of passkey/passwordless registration codes, consistent with CVE-2026-105209 cross-organization account takeover attempts against ZITADEL before 3.4.15 / 4.17.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105209
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098
  - attack.t1078
logsource:
  product: linux
  service: zitadel
detection:
  selection:
    event_type|contains:
      - 'user.v2.passkey.registration.code.added'
      - 'user.v2.passwordless.registration.code.added'
      - 'PasskeyRegistrationCode'
      - 'PasswordlessRegistrationCode'
  condition: selection
falsepositives:
  - Bulk legitimate onboarding campaigns generating many enrollment codes
level: medium
---
title: ZITADEL Enrollment Code Request With Mismatched Organization Context
id: 8c1d4e60-2f9b-4a37-b5d6-1e8c3a7f9246
status: experimental
description: Detects ZITADEL user v2 API calls that create passkey or passwordless registration codes where the x-zitadel-orgid header organization differs from the target user's organization — the exact exploitation signature of CVE-2026-105209. Requires reverse proxy / ingress logging that captures the x-zitadel-orgid header and the target user ID.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105209
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098
  - attack.privilege_escalation
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/v2/users/'
  selection_method:
    cs-method: 'POST'
  selection_action:
    cs-uri|contains:
      - 'passkey'
      - 'passwordless'
  condition: selection_uri and selection_method and selection_action
falsepositives:
  - Legitimate helpdesk-driven passkey enrollment within the caller's own organization (filter where org header matches target user org)
level: high
---
title: Passkey Registration Completion Followed by Authentication From New Source
id: 5b9e3d17-6c4a-48f2-a0d9-7f2e1b6c8530
status: experimental
description: Detects successful ZITADEL authentication using a newly registered passkey/passwordless credential from a source IP or user agent not previously associated with the account, indicating possible post-takeover access following CVE-2026-105209 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105209
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  product: linux
  service: zitadel
detection:
  selection:
    event_type|contains:
      - 'user.v2.passkey.added'
      - 'user.v2.passwordless.added'
      - 'passkey.login.succeeded'
      - 'passwordless.login.succeeded'
  condition: selection
falsepositives:
  - Users legitimately enrolling and immediately using passkeys on new devices
level: low

// Hunt: ZITADEL CVE-2026-105209 — cross-org passkey/passwordless enrollment code abuse
let lookback = 14d;
let EnrollEvents = Syslog
| where TimeGenerated > ago(lookback)
| where SyslogMessage has_any ("PasskeyRegistrationCode", "PasswordlessRegistrationCode", "registration.code.added")
| extend CallerOrg = extract(@"x-zitadel-orgid[:\"= ]+([A-Za-z0-9-]+)", 1, SyslogMessage),
         TargetUserOrg = extract(@"user_org[:\"= ]+([A-Za-z0-9-]+)", 1, SyslogMessage),
         CallerId = extract(@"caller[:\"= ]+([A-Za-z0-9._@-]+)", 1, SyslogMessage),
         TargetUser = extract(@"user_id[:\"= ]+([A-Za-z0-9-]+)", 1, SyslogMessage);
EnrollEvents
| extend OrgMismatch = iff(isnotempty(CallerOrg) and isnotempty(TargetUserOrg) and CallerOrg != TargetUserOrg, 1, 0)
| summarize EventCount = count(), MismatchedOrgEvents = sum(OrgMismatch), DistinctTargets = dcount(TargetUser), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by CallerId
| where MismatchedOrgEvents > 0 or EventCount >= 10
| project CallerId, EventCount, MismatchedOrgEvents, DistinctTargets, FirstSeen, LastSeen
| order by MismatchedOrgEvents desc, EventCount desc;
// Secondary: new passkey auth from previously unseen source after any enrollment event
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where AdditionalExtensions has "passkey.login.succeeded"
| summarize FirstSeenFromSource = min(TimeGenerated), AuthCount = count() by SourceIP, DestinationUserName
| where AuthCount <= 3
| order by FirstSeenFromSource desc;

-- Hunt for vulnerable ZITADEL deployments (CVE-2026-105209): binary presence, version strings, and running services
LET binaries = SELECT FullPath, Size, Mtime
FROM glob(globs=['/usr/local/bin/zitadel', '/opt/**/zitadel', '/usr/bin/zitadel', '/var/lib/**/zitadel'])
WHERE NOT IsDir;

LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)zitadel' OR CommandLine =~ '(?i)zitadel';

SELECT * FROM binaries
UNION ALL
SELECT Exe AS FullPath, NULL AS Size, CreateTime AS Mtime FROM procs;

#!/usr/bin/env bash
# CVE-2026-105209 - ZITADEL cross-org passkey enrollment verification & audit
set -euo pipefail

echo "=== [1] Detect ZITADEL version ==="
if command -v zitadel >/dev/null 2>&1; then
  VER=$(zitadel --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
elif command -v docker >/dev/null 2>&1 && docker ps --format '{{.Image}}' | grep -qi zitadel; then
  IMG=$(docker ps --format '{{.Image}}' | grep -i zitadel | head -n1)
  VER=$(echo "$IMG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  echo "Container image: $IMG"
else
  echo "ZITADEL not found locally - check your orchestrator (k8s: kubectl get deploy -A -o wide | grep -i zitadel)"
  VER=""
fi

echo "Detected version: ${VER:-unknown}"

# Vulnerable: 3.x < 3.4.15, 4.x < 4.17.1
if [ -n "${VER:-}" ]; then
  MAJOR=$(echo "$VER" | cut -d. -f1); MINOR=$(echo "$VER" | cut -d. -f2); PATCH=$(echo "$VER" | cut -d. -f3)
  VULN=0
  if [ "$MAJOR" -eq 3 ]; then
    if [ "$MINOR" -lt 4 ] || { [ "$MINOR" -eq 4 ] && [ "$PATCH" -lt 15 ]; }; then VULN=1; fi
  elif [ "$MAJOR" -eq 4 ]; then
    if [ "$MINOR" -lt 17 ] || { [ "$MINOR" -eq 17 ] && [ "$PATCH" -lt 1 ]; }; then VULN=1; fi
  elif [ "$MAJOR" -lt 3 ]; then
    VULN=1
  fi
  if [ "$VULN" -eq 1 ]; then
    echo "[!] VULNERABLE to CVE-2026-105209 - upgrade to 3.4.15 (3.x) or 4.17.1 (4.x) IMMEDIATELY"
  else
    echo "[+] Version appears patched."
  fi
fi

echo "=== [2] Audit recent logs for enrollment-code issuance (last 24h) ==="
LOGSRC="/var/log"
journalctl -u zitadel --since "24 hours ago" --no-pager 2>/dev/null | grep -iE "PasskeyRegistrationCode|PasswordlessRegistrationCode|registration.code" || \
grep -riE "PasskeyRegistrationCode|PasswordlessRegistrationCode|registration.code" "$LOGSRC" 2>/dev/null | tail -n 50 || \
echo "No local enrollment events found - verify via SIEM/ingress logs"

echo "=== [3] If running behind a reverse proxy, confirm x-zitadel-orgid is logged ==="
echo "Add to nginx ingress:  log_format with \$http_x_zitadel_orgid"

echo "=== [4] Remediation ==="
echo "Binary:  download 3.4.15 / 4.17.1 from https://github.com/zitadel/zitadel/releases"
echo "Docker:  docker pull ghcr.io/zitadel/zitadel:v4.17.1 && redeploy"
echo "K8s:     helm upgrade zitadel zitadel/zitadel --set image.tag=v4.17.1 -n zitadel"