ZITADEL Passkey Registration Code Validation Vulnerability Allowing Account Takeover

A vulnerability in ZITADEL's passkey registration endpoints prior to versions 3.4.8 and 4.12.2 allows an attacker to register a passkey using an expired code. The flaw arises from an improper expiration check, which could enable an attacker to reset the expiration window of a code and register their own passkey, gaining access to the victim's account. This issue affects ZITADEL versions 4.0.0 through 4.12.1, 3.0.0 through 3.4.7, and all 2.x versions up to 2.71.19.

Impact

Exploitation of this vulnerability could lead to unauthorized access to a victim's account by allowing an attacker to register a passkey for the account, effectively taking over the account.

Remediation

Users can upgrade to ZITADEL versions 4.12.2 or 3.4.8 to address this vulnerability. Instructions for downloading these versions are available on the ZITADEL GitHub Releases page.