GHSA-vg5j-vf6h-586m

ZITADEL’s Login V2 UI made several internal server-side functions callable from the outside without authentication. These functions were only meant to be used by the Login UI itself, and they ran with the Login V2 service account, which has instance-wide permissions.

The functions accepted the user they act on, the link they send by email, or the session lifetime directly from the request. Login V2 did not check that the caller was signed in as that user or allowed to choose those values.

An unauthenticated attacker who knows a user’s ID can:

• Take over accounts that have not set up an authentication method yet, such as invited users who have not accepted their invite. ZITADEL sends the user a genuine verification or invite email, but with a link to a host the attacker controls. When the link is opened — by the user or by an automated link scanner — the attacker receives the code and can set the account’s first credential.
• Mark the user as having skipped the MFA setup prompt.