CVE-2026-54693High▾ TwilightZITADEL Users Can Self-Verify Email/Phone via API
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.
While GHSA-282g-fhmx-xf54 (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling UpdateHumanUser with email.is_verified: true, additional paths were discovered.
Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.
Due to an improper permission check, the API allowed returning the verification code for the email and phone to the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.
Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.
Systems running one of the following versions are affected:
4.0.0 through 4.15.0 (including RC versions)3.0.0 through 3.4.10 (including RC versions)2.43.0 through 2.71.19The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.
4.x: Upgrade to >=4.15.1 3.x: Update to >=3.4.11 2.x: Update to >=3.4.11
The recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent returning the verification code to the own user.
If you have any questions or comments about this advisory, please email us at [email protected]
Thanks to eddieran for reporting this vulnerability.
github.com/zitadel/zitadel >= 4.0.0, < 4.15.1github.com/zitadel/zitadel >= 2.43.0, < 3.4.11github.com/zitadel/zitadel < 1.80.0-v2.20.0.20260608144108-ed09b3df7f43Upgrade to a patched release:
github.com/zitadel/zitadel 1.80.0-v2.20.0.20260608144108-ed09b3df7f43Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55672High· 7.4ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
CVE-2026-56668High· 8.1ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-76081Medium· 5.5ZITADEL is an open source identity management platform
CVE-2023-47111High· 7.3ZITADEL race condition in lockout policy execution
CVE-2023-22492Medium· 5.9Zitadel RefreshToken invalidation vulnerability
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection