CVE-2026-32132 ZITADEL: Reactivation of Expired Passkey Registration Codes
Attackers can reuse expired passkey registration codes to register their own passkeys and take over victim accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32132?
CVE-2026-32132 is a high-severity vulnerability in zitadel, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.
Weakness: CWE-613
Which versions are affected by CVE-2026-32132?
It affects 1 product.
Products include Zitadel Zitadel.
How do I fix CVE-2026-32132?
No fix has been published for CVE-2026-32132 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32132 being exploited?
There is no known exploitation of CVE-2026-32132 in the wild and no public exploit code.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
Sources
Also known as GHSA-2x66-r53r-9r86.