CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

State: Published
Severity: 9.1 Critical
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 29, 2026

Description

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-565 Reliance on Cookies without Validation and Integrity Checking

Affected Products

Product	Versions
zitadelzitadel	4.0.0 to before 4.19.5Affected 4.19.5Not affected

References

GitHub Security Advisory (GHSA-84fg-x5h4-w8xv)vendor-advisory
VulnCheck Advisory: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookiethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.