CVE-2026-119128 in Zitadel
Summary
by MITRE • 10/29/2026
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in ZITADEL versions prior to 4.19.5 represents a critical authentication bypass flaw within the Login V2 User Interface component. This security defect specifically targets users who have not yet established any form of primary authentication method, such as passwords or multi-factor authentication tokens. The core technical issue stems from an insufficient validation mechanism when handling verification checks during account setup processes. Attackers can exploit this weakness by computing a valid verificationCheck cookie using the target user's unique identifier and their browser fingerprint information. This capability allows malicious actors to bypass standard security controls that are designed to ensure legitimate users initiate credential creation or identity linking procedures, effectively granting them unauthorized administrative control over new or unverified accounts.
From an operational perspective, this vulnerability enables account takeover scenarios where attackers can set a password for the victim, register a passkey, or link an external identity provider without possessing any prior credentials. This is particularly dangerous in systems like ZITADEL that serve as central identity providers for multiple applications and services. Once an attacker establishes these authentication methods under their control, they gain persistent access to the compromised account. This can lead to unauthorized data access, privilege escalation within connected downstream systems, and potential lateral movement across enterprise networks if the compromised identity is used to authenticate against other protected resources. The ability to manipulate verification states remotely significantly lowers the barrier for entry compared to traditional brute-force or credential-stuffing attacks.
The technical root cause aligns with CWE-287 Improper Authentication, as the system fails to adequately verify that the entity requesting authentication changes is indeed the legitimate user associated with the account identifier. Furthermore, the exploitation technique involving browser fingerprinting and cookie manipulation relates closely to CWE-345 Insufficient Verification of Data Authenticity. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK techniques such as T1078 Valid Accounts for initial access and potentially T1621 Multi-Factor Authentication Request Interception if the attack vector extends to intercepting or manipulating multi-factor challenges during the setup phase. The flaw highlights a critical gap in state management where session tokens or verification cookies are derived from predictable or partially observable inputs like user IDs and browser fingerprints, which can be reconstructed by an attacker with limited but sufficient contextual information about the target environment.
Mitigation strategies must prioritize immediate patching to version 4.19.5 or later, as this release contains the necessary fixes for the authentication logic flaws in Login V2 UI. Organizations should also implement defense-in-depth measures including strict input validation on all user-facing endpoints that handle identity verification states. It is advisable to ensure that session tokens and verification cookies are generated using cryptographically secure random values rather than predictable identifiers like user IDs combined with browser fingerprints. Additionally, implementing rate limiting on authentication-related API calls can help mitigate automated exploitation attempts. Security teams should monitor for unusual patterns in account creation or credential change events, particularly those originating from new IP addresses or devices associated with accounts that previously had no active sessions. Regular security audits focusing on identity and access management components are essential to detect similar logic flaws before they can be exploited in production environments.