Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

ZITADEL login lets attackers hijack accounts

CVE-2026-119128 · published today
Summary

Versions of ZITADEL before 4.19.5 let an unauthenticated person trick the login page and set a password or add a login method for any user who does not already have one. The attacker can create a special cookie using the user’s ID and browser data, giving them full control of the account. Update ZITADEL to version 4.19.5 or later, and apply any recommended patches, to prevent this risk.

What to do
  • Update zitadel zitadel to version 4.19.5 or later.
Affected software
VendorProductAffected versions
zitadel zitadel < 4.19.5
Original advisory text
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-565Reliance on Cookies without Validation and Integrity Checking
Timeline
Published29 Oct 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
CVE-2026-119128 · NVD
CVE-2026-119128 · MITRE
Track software like this
Free during beta