CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API
Attackers can bypass email or phone verification checks to claim ownership of unverified contact details, potentially bypassing security policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54693?
CVE-2026-54693 is a high-severity missing authorization vulnerability in zitadel, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-54693?
8 open source packages ship an affected version, including github.com/zitadel/zitadel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | None |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
github.com/zitadel/zitadel Go | From 2.43.0 | None |
github.com/zitadel/zitadel Go | From 2.43.0 | None |
2 more packages
github.com/zitadel/zitadel Go | From 4.0.0 | None |
github.com/zitadel/zitadel Go | From 4.0.0 | None |
How do I fix CVE-2026-54693?
Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54693 being exploited?
There is no known exploitation of CVE-2026-54693 in the wild and no public exploit code.
Sources
Also known as GHSA-jq8w-8q2f-ffm9, GO-2026-6141.