cve.bz

CVE-2026-54693

8.2 highEPSS 0.6%

High (8.2). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/zitadel/zitadel 1.80.0-v2.20.0.20260608144108-ed09b3df7f43.

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.

Severity

CVSS 4.0

8.2 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jq8w-8q2f-ffm9Gogithub.com/zitadel/zitadel>=4.0.0no fix published
GHSA-jq8w-8q2f-ffm9Gogithub.com/zitadel/zitadel>=2.43.0no fix published
GHSA-jq8w-8q2f-ffm9Gogithub.com/zitadel/zitadel<1.80.0-v2.20.0.20260608144108-ed09b3df7f431.80.0-v2.20.0.20260608144108-ed09b3df7f43
GO-2026-6141Gogithub.com/zitadel/zitadelall versionsno fix published
GO-2026-6141Gogithub.com/zitadel/zitadelall versionsno fix published
GO-2026-6141Gogithub.com/zitadel/zitadel<1.80.0-v2.20.0.20260608144108-ed09b3df7f431.80.0-v2.20.0.20260608144108-ed09b3df7f43

References

Check your stackJSON