Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-109373: ZITADEL lets attackers hijack user accounts
CVE-2026-109373 · published 13 days ago
Summary
Versions of ZITADEL before 4.19.2 let an unauthenticated person create fake login cookies and take over other users' accounts, even those with multi‑factor authentication. This can give an attacker full control of admin and regular user sessions. Update ZITADEL to version 4.19.2 or later as soon as possible to stop the risk.
What to do
- Update zitadel zitadel to version 4.19.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zitadel | zitadel | < 4.19.2 |
Original advisory text
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109373 Vendor Advisory
- https://github.com/zitadel/zitadel/security/advisories/GHSA-jh92-5mrj-p2w2 Vendor Advisory
- https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeove... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Timeline
Published12 Oct 2026
Updated26 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109373 · NVD
CVE-2026-109373 · OSV
GHSA-jh92-5mrj-p2w2 · GHSA
CVE-2026-109373 · MITRE
Track software like this
Free during beta