CVE-2026-119128
zitadel zitadel
- zitadel zitadel
- Critical
- CVSS 9.1
- Fixed version listed
Summary
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method.
From the CVE record.
Read the original description
CVE record
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| zitadel zitadel | from 4.0.0, before 4.19.5 | 4.19.5 |
Advisories and fixes
- Vendor advisory github.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0, scored by VulnCheck)
- Weakness
- CWE-565: Reliance on Cookies without Validation and Integrity Checking
- Vendor
- zitadel, zitadel
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.