« Volver al listado

CVE-2026-32132

Estado: AnalizadaAlta (7.4)—

ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto sin privilegios ni interacción a endpoint expuesto (passkey registration). Impacto: obtención de credenciales válidas (code expirado reutilizable) y control de cuenta de usuario víctima.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementMulti-factor AuthenticationVulnerability ScanningUser TrainingPrivileged Process IntegrityPassword Policies

Tecnologías afectadas (1)

Zitadel — Zitadel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32132",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32132",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T15:11:28.138761Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.12.2"
            },
            {
              "status": "affected",
              "version": "< 3.4.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-11T22:16:33.120",
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."
    },
    {
      "lang": "es",
      "value": "ZITADEL es una plataforma de gestión de identidad de código abierto. Antes de las 3.4.8 y 4.12.2, existe una posible vulnerabilidad en los puntos finales de registro de passkey de Zitadel. Este punto final permite registrar una nueva passkey utilizando un código recuperado previamente. Una comprobación de caducidad incorrecta del código podría permitir a un atacante registrar potencialmente su propia passkey y obtener acceso a la cuenta de la víctima. Esta vulnerabilidad está corregida en las 3.4.8 y 4.12.2."
    }
  ],
  "lastModified": "2026-06-17T10:35:11.587",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D10CA4D8-E0F2-4E5B-96D6-8A07147E3BCD",
              "versionEndExcluding": "3.4.8"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21EAC256-F692-4F79-BF00-FED9934BAA7A",
              "versionEndExcluding": "4.12.2",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}