CVE-2026-54693: ZITADEL Users Can Self-Verify Email/Phone via API
A vulnerability in Zitadel’s self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.
While GHSA-282g-fhmx-xf54 (CVE-2026-27946, “Users Can Self-Verify Email/Phone via UpdateHumanUser API”) closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling UpdateHumanUser with email.is_verified: true, additional paths were discovered.
References
- github.com/advisories/GHSA-jq8w-8q2f-ffm9
- github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d
- github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151
- github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f
- github.com/zitadel/zitadel/releases/tag/v3.4.11
- github.com/zitadel/zitadel/releases/tag/v4.15.1
- github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9
- nvd.nist.gov/vuln/detail/CVE-2026-54693
Code Behaviors & Features
Detect and mitigate CVE-2026-54693 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →