8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29193

CVE-2026-29193: ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton. This issue has been patched in version 4.12.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29193

CVE-2026-29193:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel/v2	go	>= 4.0.0, <= 4.12.0	4.12.1
github.com/zitadel/zitadel	go	>= 4.0.0, <= 4.12.0	4.12.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ZITADEL login V2 UI, where server-side functions responsible for user registration and authentication failed to properly enforce configured security policies. The analysis of the patch commit b4efc80 reveals that several functions in apps/login/src/lib/server/password.ts and apps/login/src/lib/server/register.ts were modified to include necessary policy checks.

The root cause was the absence of checks for policies like allowRegister, allowLocalAuthentication, and hidePasswordReset at the beginning of the respective functions. This allowed an attacker to send direct HTTP requests to the server, bypassing the UI and invoking these functions to perform actions that should have been disallowed by the organization's settings. For example, an attacker could register a new user even if self-registration was disabled, or authenticate with a password when only passwordless methods were supposed to be allowed.

The patch rectifies this by adding the policy enforcement logic at the entry point of the vulnerable functions (resetPassword, sendPassword, registerUser, registerUserAndLinkToIDP), ensuring that the security settings are respected before proceeding with any sensitive operations. During exploitation, these function names would appear in a runtime profile or stack trace.

Vulnerable functions

resetPassword

apps/login/src/lib/server/password.ts

The function `resetPassword` was vulnerable because it did not check if password reset was disabled by the organization's policy (`hidePasswordReset`). The patch adds this check at the beginning of the function, preventing password resets when not allowed.

sendPassword

apps/login/src/lib/server/password.ts

The `sendPassword` function was vulnerable as it allowed password-based authentication even when local authentication was disabled in the organization's policy. The patch introduces a check to enforce the `allowLocalAuthentication` policy when a user tries to authenticate without an existing session, which is the case for direct server requests.

registerUser

apps/login/src/lib/server/register.ts

The `registerUser` function was vulnerable because it created a new user before checking if self-registration (`allowRegister`) or password-based registration (`allowLocalAuthentication`) was permitted by the organization's policy. The patch moves the policy checks to the beginning of the function, ensuring policies are enforced before any user creation occurs.

registerUserAndLinkToIDP

apps/login/src/lib/server/register.ts

The `registerUserAndLinkToIDP` function was vulnerable as it did not verify if user self-registration was allowed before creating a user and linking it to an identity provider. The patch adds a check for the `allowRegister` policy at the start of the function to prevent unauthorized user creation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.