CVE-2026-32132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32132", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:19:36.545Z", "datePublished": "2026-03-11T21:40:07.055Z", "dateUpdated": "2026-03-12T16:17:54.535Z"}, "containers": {"cna": {"title": "ZITADEL: Reactivation of Expired Passkey Registration Codes", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2"}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"version": ">= 4.0.0, < 4.12.2", "status": "affected"}, {"version": "< 3.4.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T21:40:07.055Z"}, "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."}], "source": {"advisory": "GHSA-2x66-r53r-9r86", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:11:28.138761Z", "id": "CVE-2026-32132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:17:54.535Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T15:11:28.138761Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:11:33.189Z"}}], "cna": {"title": "ZITADEL: Reactivation of Expired Passkey Registration Codes", "source": {"advisory": "GHSA-2x66-r53r-9r86", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.12.2"}, {"status": "affected", "version": "< 3.4.8"}]}], "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86", "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8", "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2", "name": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T21:40:07.055Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32132", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:17:54.535Z", "dateReserved": "2026-03-10T22:19:36.545Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T21:40:07.055Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zitadel", "vendor": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.12.2"}, {"status": "affected", "version": "< 3.4.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D10CA4D8-E0F2-4E5B-96D6-8A07147E3BCD", "versionEndExcluding": "3.4.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:-:*:*:*:*:*:*", "matchCriteriaId": "21EAC256-F692-4F79-BF00-FED9934BAA7A", "versionEndExcluding": "4.12.2", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. Antes de las 3.4.8 y 4.12.2, existe una posible vulnerabilidad en los puntos finales de registro de passkey de Zitadel. Este punto final permite registrar una nueva passkey utilizando un c\u00f3digo recuperado previamente. Una comprobaci\u00f3n de caducidad incorrecta del c\u00f3digo podr\u00eda permitir a un atacante registrar potencialmente su propia passkey y obtener acceso a la cuenta de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en las 3.4.8 y 4.12.2."}], "id": "CVE-2026-32132", "lastModified": "2026-06-17T10:35:11.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32132", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:11:28.138761Z", "version": "2.0.3"}}]}, "published": "2026-03-11T22:16:33.120", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.12.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zitadel", "source": "cna", "vendor": "zitadel"}, "product": "zitadel", "vendor": "zitadel"}], "analysis": {"en": {"generated_at": "2026-03-17T17:04:37.073493+00:00", "value": {"mitigation_remediation": ["Upgrade to Zitadel version 3.4.8 or later, or 4.12.2 or later, which contain the fix for the improper expiration check."], "summary": {"action": "Patch", "impact": "Unauthorized Passkey Registration (Account Takeover)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Zitadel identity management platform (vendor zitadel:zitadel) in all releases prior to version 3.4.8 and 4.12.2. Any deployment using these older versions is susceptible until the patches in the indicated releases are applied.", "description_and_impact": "ZITADEL\u2019s passkey registration endpoints perform an improper expiration check on registration codes. When an expired or previously retrieved code is reused, the system accepts it and registers the supplied passkey. This flaw allows an attacker to add a new credential to a victim\u2019s account, effectively granting the attacker authentication rights for that account.", "risk_and_exploitability": "The CVSS v3 score of 7.4 indicates high severity. The EPSS score is reported as less than 1\u202f%, implying a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the attack vector is remote via the web API, specifically through the passkey registration endpoint. An attacker who obtains or reuses an expired registration code can submit it to the endpoint, bypass the expiration check, and register a new passkey, thereby gaining access to the victim\u2019s account."}}}}, "created": "2026-03-12T09:55:42.499795+00:00", "updated": "2026-03-20T15:36:50.954779+00:00", "vendors": ["zitadel", "zitadel$PRODUCT$zitadel"]}