CVE-2026-109373 in Zitadel
Summary
by MITRE • 10/12/2026
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in ZITADEL versions prior to 4.19.2 represents a critical authentication bypass flaw within the Login V2 user interface component. This security defect stems from an improper validation of session cookies, specifically allowing attackers to manipulate unsigned or empty session tokens to interact with the backend identity provider services. The core technical issue lies in the application's handling of time-ordered session identifiers combined with weak token verification logic during the authentication flow. When a user initiates a login process, ZITADEL generates unique session IDs that are sequentially assigned based on creation timestamps. Due to this predictable ordering and insufficient cryptographic binding between the session ID and its corresponding state or signature validation in certain code paths, an attacker can exploit the temporal proximity of these identifiers. By guessing session IDs that were generated immediately before or after a legitimate user's sign-in attempt, an adversary can craft requests containing empty or malformed tokens. The system erroneously accepts these inputs and proceeds to rotate them into valid, active session tokens. This mechanism effectively allows unauthenticated actors to hijack existing sessions without possessing the victim's credentials or multi-factor authentication secrets.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of user accounts managed by ZITADEL. Attackers can achieve full account takeover for any user whose session ID falls within the guessable range relative to a target login event. This includes high-privilege accounts such as system administrators who have already completed multi-factor authentication processes. Once an attacker obtains a valid rotated token, they gain unrestricted access to the victim's profile, personal data, and administrative controls depending on their role. The ability to bypass MFA checks by hijacking post-authentication sessions negates one of the primary security layers intended to protect sensitive identities. This leads to potential unauthorized modifications of organizational settings, exfiltration of confidential user information, and further lateral movement within connected systems that trust ZITADEL for identity verification.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the authenticity of credentials or session identifiers before granting access. It also relates to CWE-384 Session Fixation and CWE-613 Insufficient Session Expiration when considering how old tokens are handled during rotation. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique for hijacking valid sessions or credentials through manipulation rather than brute force. The attack vector involves remote exploitation over a network connection where the attacker interacts with the web interface to forge requests and harvest tokens.
To mitigate this vulnerability, organizations running ZITADEL must immediately upgrade to version 4.19.2 or later, which contains patches addressing the session token validation logic and strengthening the cryptographic binding of session identifiers. Until an upgrade is feasible, administrators should implement strict rate limiting on login endpoints to reduce the window for successful guessing attacks and monitor logs for anomalous patterns such as rapid succession of empty token rotations associated with single IP addresses. Additionally, enforcing shorter session lifetimes can limit the effectiveness of time-based prediction by reducing the validity period of any compromised tokens. Security teams should also review access policies to ensure that critical administrative functions require re-authentication or step-up authentication even after initial login, thereby adding a layer of defense against session hijacking attacks.