The Critical Vulnerability: Passkey Enrollment & Enterprise Account Takeover

Passkeys represent a significant leap forward in authentication, promising a more secure, phishing-resistant future. However, as with any emerging technology, the devil often lies in the implementation. Recent disclosures regarding a cluster of vulnerabilities in ZITADEL, an open-source identity and access management (IAM) platform, underscore a critical truth for enterprises: the security of passkeys is only as strong as the systems enabling their enrollment and management.

The ZITADEL Vulnerability Cluster: A Wake-Up Call

On October 4, 2026, ZITADEL disclosed seven vulnerabilities, with one standing out due to its severity: CVE-2026-105209, a critical improper authorization flaw with a CVSS 9.3 rating. This vulnerability allows for cross-organization account takeover via passkey enrollment. The core issue was that when issuing passkey or passwordless enrollment codes, ZITADEL only checked the organization ID (x-zitadel-orgid) in the request header, completely ignoring the target user's actual organization affiliation. CVE-2026-105209

This meant that an attacker with minimal write permissions in one organization could exploit this flaw to obtain an enrollment code for a user in another organization on the same ZITADEL instance. With this code, they could register their own authenticator (e.g., a hardware security key or a biometric device) to the victim's account, effectively taking it over. This scenario bypasses the very phishing resistance that passkeys are designed to provide, shifting the attack vector from user interaction to flawed system logic.

Why Enrollment Flows Are the New Attack Surface

The ZITADEL vulnerability is not an isolated incident but a stark illustration of an emerging pattern. As passkeys become the default for enterprise identity services, attackers are meticulously scrutinizing the less-trodden paths: enrollment and recovery flows. TechReaderDaily reported that as Microsoft makes passkeys the primary authentication method in Entra ID, attackers are increasingly targeting WebAuthn enrollment and recovery. The security of the passkey itself is robust; the challenge lies in the processes surrounding its lifecycle management.

Attackers are adapting their tactics, moving beyond traditional phishing lures to exploit weaknesses in the provisioning of passkeys. This includes social engineering tactics designed to trick users or administrators into:

• Initiating passkey enrollment on an attacker-controlled device.
• Approving unauthorized passkey registrations.
• Revealing sensitive information during recovery processes that could lead to passkey compromise.

The "Pass-ta-key" attacks and vishing campaigns that exploit passkey enrollment flows have been highlighted in recent security research as critical areas of concern. While passkeys are inherently phishing-resistant at the point of authentication, the steps before authentication—enrollment and recovery—introduce new attack surfaces that require robust controls and user education.

Implications for Enterprise Security Teams

For enterprise security architects, CISOs, and IAM engineers, the ZITADEL disclosures and similar emerging attack vectors offer crucial lessons:

1. Trust No Implementation: While the FIDO2 standard underpinning passkeys is strong, its implementation by vendors must be rigorously vetted. Enterprises adopting passkeys must ensure their chosen IAM solutions have robust security controls around all aspects of passkey lifecycle management, especially enrollment and recovery.
2. Focus on the Full Lifecycle: Security teams often prioritize the authentication event itself. The shift to passkeys demands a broader perspective, encompassing the entire passkey lifecycle: issuance, enrollment, revocation, recovery, and management. Each stage presents potential vulnerabilities if not secured comprehensively.
3. Cross-Organizational Isolation is Paramount: For multi-tenant or federated identity systems, strict logical and technical isolation between organizations is non-negotiable. The ZITADEL vulnerability demonstrated the catastrophic impact when organizational boundaries are insufficiently enforced during critical operations like credential enrollment.
4. Audit and Monitor Enrollment Events: Implement comprehensive logging and monitoring for all passkey enrollment and recovery events. Anomalous activities, such as passkey registrations from unusual locations or for privileged accounts, should trigger immediate alerts and investigations.
5. User Education is Still Critical: Even with phishing-resistant authentication, social engineering remains a threat. Users need to be educated about the legitimate processes for passkey enrollment and recovery, and warned against unexpected requests to register or confirm passkeys.
6. Vendor Diligence: Continuously assess your identity provider's security posture and responsiveness to vulnerabilities. Open-source solutions, while offering transparency, require vigilant monitoring of security advisories and timely patching.

Protecting Your Enterprise from Passkey Enrollment Exploits

To mitigate the risks highlighted by the ZITADEL vulnerability and the evolving passkey attack landscape, enterprises should take proactive steps:

• Regularly Update IAM Systems: Ensure all identity and access management platforms are running the latest patched versions. This includes promptly applying security fixes for critical vulnerabilities like CVE-2026-105209.
• Implement Strong Access Controls for Enrollment: Restrict who can initiate or approve passkey enrollment, particularly for privileged accounts. Consider multi-factor approval processes for sensitive enrollments.
• Review and Harden Enrollment Workflows: Analyze your organization's passkey enrollment and recovery workflows. Are there any steps that could be exploited through social engineering or improper authorization? Simplify and secure these processes as much as possible.
• Enhance Identity Governance: Ensure that user identities and their associated organizational affiliations are correctly and securely managed. This helps prevent cross-organization identity manipulation.
• Develop Incident Response Plans for Passkey Compromise: Prepare for scenarios where passkeys might be illicitly registered or compromised. This includes clear procedures for immediate revocation and re-provisioning of secure credentials.

Passkeys offer an undeniable advantage in the fight against phishing and account takeover. However, their true enterprise security benefit can only be realized when the entire ecosystem—from the underlying standards to the vendor implementations and internal enterprise processes—is secured with meticulous attention to detail. The ZITADEL vulnerabilities serve as a potent reminder that vigilance, continuous assessment, and a comprehensive security strategy extending beyond the authentication event itself are indispensable.