CVE-2026-32132: 
NixOS vulnerability analysis and mitigation

CVE-2026-32132 is a passkey registration code reactivation vulnerability in ZITADEL, an open-source identity management platform. Due to an improper expiration check in the passkey registration endpoint, an attacker can reuse an expired registration code to register their own passkey on a victim's account, enabling full account takeover. Affected versions include ZITADEL 3.x prior to 3.4.8, 4.0.0 through 4.12.1, and 2.x through 2.71.19. The vulnerability was published on March 11, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration). ZITADEL's passkey registration flow allows users to generate a time-limited code (typically delivered via email) to register a new authenticator device. The flaw lies in how failed verification attempts are handled: each failed attempt incorrectly resets the expiration window rather than maintaining the original creation-based expiry, effectively reactivating an expired code. An attacker who obtains or enumerates an expired passkey registration code can exploit this by submitting repeated failed verification attempts to reset the expiration, then successfully submitting the code to register their own passkey. The patch resolves this by correctly evaluating expiration against the code's creation date rather than the last verification attempt (GitHub Advisory, v3.4.8 Release).

Successful exploitation allows an attacker to register an unauthorized passkey (WebAuthn credential) on a victim's ZITADEL account, resulting in full account takeover. This yields high confidentiality impact (access to all data and resources associated with the victim's identity) and high integrity impact (ability to modify account settings, credentials, and associated resources). Availability is not directly impacted. Because ZITADEL serves as an identity provider, compromise of a single account could facilitate lateral movement to any downstream application or service relying on ZITADEL for authentication (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The attack requires no privileges and no user interaction but is rated High complexity, as the attacker must obtain or enumerate a valid (even expired) passkey registration code. The EPSS score is approximately 0.028% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target ZITADEL instance running a vulnerable version (3.x < 3.4.8, 4.0.0–4.12.1, or 2.x ≤ 2.71.19) and obtain a target user's account identifier.
2. Obtain an expired code: Acquire a passkey registration code that was previously generated for the victim's account — either through interception (e.g., email access), social engineering, or enumeration of code values if the code space is predictable.
3. Reset the expiration window: Submit repeated failed verification attempts to the ZITADEL passkey registration endpoint using the expired code. Each failed attempt incorrectly resets the expiration timer, effectively reactivating the code.
4. Register attacker's passkey: Once the expiration window has been reset, submit a valid WebAuthn registration response using the reactivated code to register the attacker's own authenticator device to the victim's account.
5. Account takeover: Use the newly registered passkey to authenticate as the victim, gaining full access to their ZITADEL account and any downstream services relying on ZITADEL for identity (GitHub Advisory).

• Logs: Multiple failed passkey registration code verification attempts for the same user account in a short time window, followed by a successful passkey registration — particularly for codes that should have already expired.
• Logs: Unexpected passkey (WebAuthn credential) registration events for accounts where the user did not initiate a new device registration.
• Network: Repeated API calls to ZITADEL's passkey registration endpoint (/v2/users/{userId}/passkeys or equivalent) from an IP address not associated with the legitimate account owner.
• Application Events: New passkey/WebAuthn credential appearing in a user's account without a corresponding user-initiated action, especially from an unfamiliar device or browser fingerprint.
• Authentication Logs: Subsequent logins using a passkey from an unrecognized device or geographic location shortly after suspicious registration activity (GitHub Advisory).

Upgrade ZITADEL to a patched version immediately: 3.4.8 or later for 3.x deployments, 4.12.2 or later for 4.x deployments, and 3.4.8 or later for 2.x deployments (no separate 2.x patch is provided). The fix corrects the expiration check to evaluate against the code's creation date rather than the last failed attempt. No configuration-based workaround is available; upgrading is the only recommended remediation. After upgrading, administrators should review passkey registration audit logs for any suspicious registrations that occurred during the vulnerability window and revoke any unauthorized passkeys (GitHub Advisory, v3.4.8 Release, v4.12.2 Release).

The vulnerability was reported by security researcher odgrso and coordinated through GitHub's security advisory process. The fix was developed by ZITADEL maintainer muhlemmer and reviewed by grvijayan, with coordination by livio-a. Community reaction on social media (Bluesky) was noted shortly after disclosure, though no major media coverage or significant public commentary beyond the advisory itself has been observed (GitHub Advisory).