PT-2026-24855 · Git+1 · Zitadel

Odgrso · Published 2026-03-11 · Updated 2026-03-16 · CVE-2026-32132

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.8 ZITADEL versions prior to 4.12.2

Description ZITADEL is an open source identity management platform. A potential issue exists in the passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code could allow an attacker to potentially register their own passkey and gain access to the victim's account. The vulnerable endpoint is the passkey registration endpoint. The vulnerable variable is the code used for passkey registration.

Recommendations Update to ZITADEL version 3.4.8 or later. Update to ZITADEL version 4.12.2 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-32132

GHSA-2X66-R53R-9R86

Affected Products

Zitadel

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32132.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32132 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32132 · Vendor Advisory
• https://github.com/zitadel/zitadel/releases/tag/v4.12.2 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.8 · Note
• https://twitter.com/CVEnew/status/2031867617972002935 · Twitter Post
• https://t.me/cveNotify/155523 · Telegram Post