CVE-2026-32132

ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/zitadel/zitadel/releases/tag/v3.4.8	Product
https://github.com/zitadel/zitadel/releases/tag/v4.12.2	Product
https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zitadel:zitadel::::::::
	cpe:2.3:a:zitadel:zitadel::-::::::*

History

No history.

Information

Published : 2026-03-11 22:16

Updated : 2026-03-16 16:52

NVD link : CVE-2026-32132

Mitre link : CVE-2026-32132

CVE.ORG link : CVE-2026-32132

JSON object : View

Products Affected

zitadel

zitadel

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-32132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2026-03-11T22:16:33.120", "references": [{"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. Antes de las 3.4.8 y 4.12.2, existe una posible vulnerabilidad en los puntos finales de registro de passkey de Zitadel. Este punto final permite registrar una nueva passkey utilizando un c\u00f3digo recuperado previamente. Una comprobaci\u00f3n de caducidad incorrecta del c\u00f3digo podr\u00eda permitir a un atacante registrar potencialmente su propia passkey y obtener acceso a la cuenta de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en las 3.4.8 y 4.12.2."}], "lastModified": "2026-03-16T16:52:31.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D10CA4D8-E0F2-4E5B-96D6-8A07147E3BCD", "versionEndExcluding": "3.4.8"}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21EAC256-F692-4F79-BF00-FED9934BAA7A", "versionEndExcluding": "4.12.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}