{"uuid": "8326e003-3c2f-4deb-bcdb-fde18ede06dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54693", "type": "seen", "source": "https://gist.github.com/alon710/122d827ca97ab8457c12647e94a1482c", "content": "# CVE-2026-54693: CVE-2026-54693: Authorization Bypass in ZITADEL Identity Management Platform\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54693\n\n## Summary\nA critical authorization bypass vulnerability was identified in the ZITADEL identity management platform, tracked as CVE-2026-54693 (GHSA-jq8w-8q2f-ffm9). Due to incorrect privilege validation in self-service profile modification endpoints, standard authenticated users could obtain plaintext verification codes during email or phone number updates. This allows attackers to claim and verify arbitrary email addresses or phone numbers without controlling the underlying contact methods.\n\n## TL;DR\nZITADEL allowed self-managing users to request plaintext verification OTPs in API responses by setting the returnCode parameter to true. Standard users could exploit this logic flaw to verify arbitrary email addresses and phone numbers without possessing actual access to the targeted out-of-band communication channel.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **Exploit Status**: PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- **ZITADEL**: >= 2.43.0, < 2.71.19 (Fixed in: `2.71.19`)\n- **ZITADEL**: >= 3.0.0-rc.1, < 3.4.11 (Fixed in: `3.4.11`)\n- **ZITADEL**: >= 4.0.0-rc.1, < 4.15.1 (Fixed in: `4.15.1`)\n\n## Mitigation\n\n- Upgrade to a patched version of ZITADEL (v3.4.11 or v4.15.1).\n- Monitor API gateway logs for unauthorized use of the returnCode parameter in self-service endpoints.\n- Audit existing database and event store entries for anomalies in verification speeds.\n\n**Remediation Steps:**\n1. Identify the current running ZITADEL version and branch.\n2. Apply the update to version 3.4.11 (for v3) or 4.15.1 (for v4).\n3. Review the event store for suspicious patterns where email changes and email verifications occur within consecutive seconds.\n\n## References\n\n- [ZITADEL Security Advisory GHSA-jq8w-8q2f-ffm9](https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9)\n- [ZITADEL Release v3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11)\n- [ZITADEL Release v4.15.1](https://github.com/zitadel/zitadel/releases/tag/v4.15.1)\n- [CVE-2026-54693 Record](https://www.cve.org/CVERecord?id=CVE-2026-54693)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54693) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T17:31:36.273455Z"}