CVE-2026-32132

{"id": "CVE-2026-32132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2026-03-11T22:16:33.120", "references": [{"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2x66-r53r-9r86", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. Antes de las 3.4.8 y 4.12.2, existe una posible vulnerabilidad en los puntos finales de registro de passkey de Zitadel. Este punto final permite registrar una nueva passkey utilizando un c\u00f3digo recuperado previamente. Una comprobaci\u00f3n de caducidad incorrecta del c\u00f3digo podr\u00eda permitir a un atacante registrar potencialmente su propia passkey y obtener acceso a la cuenta de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en las 3.4.8 y 4.12.2."}], "lastModified": "2026-03-16T16:52:31.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D10CA4D8-E0F2-4E5B-96D6-8A07147E3BCD", "versionEndExcluding": "3.4.8"}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21EAC256-F692-4F79-BF00-FED9934BAA7A", "versionEndExcluding": "4.12.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}