CVE-2026-119129 in ZITADEL
Summary
by MITRE • 10/29/2026
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 prior to version 4.19.5 represents a critical failure in access control mechanisms within the Login V2 interface, specifically affecting the OAuth 2.0 device authorization flow. This flaw is classified under CWE-862, which denotes Missing Authorization, indicating that the application fails to properly verify whether an authenticated user has the requisite permissions to perform specific actions on behalf of other entities or resources. In a standard OIDC device authorization grant scenario, as defined by RFC 8628, a user must explicitly consent to authorize a client application after verifying its identity and requested scopes. However, in this vulnerable implementation, the system allows an attacker to bypass these essential consent checks by leveraging an existing active session of a victim who is already logged into the ZITADEL instance.
The operational mechanics of this exploit involve social engineering combined with technical manipulation of the authorization endpoint. An attacker initiates the device authorization flow on their own client application, which generates a unique user code and a verification URI that the end-user must visit to complete the authentication process. Instead of waiting for legitimate consent from the intended target, the attacker sends a malicious link containing this specific user code directly to a victim who is already authenticated in their browser session. When the victim clicks the link or visits the URL while maintaining an active session with valid credentials and tokens, the ZITADEL server incorrectly associates the pending device authorization request with that existing session. Consequently, the system approves the attacker's client application as authorized by the victim without requiring any explicit interaction such as clicking a consent button or reviewing scope permissions.
This bypass of project access settings via the OIDC device authorization API results in severe security implications for organizations relying on ZITADEL for identity management. The primary impact is the unauthorized acquisition of OAuth 2.0 tokens, including access and refresh tokens, which are issued to the attacker's client application under the guise of being authorized by the victim. These tokens grant the attacker full access to the resources protected by those scopes, effectively allowing them to impersonate the victim within integrated applications that trust ZITADEL as an identity provider. This scenario aligns with ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or sessions to maintain persistence and evade detection mechanisms designed to flag anomalous login behaviors.
The absence of a mandatory consent screen for device flows in this context creates a significant trust boundary violation. Typically, the device flow is designed for clients with limited input capabilities, such as smart TVs or IoT devices, where users must switch to another browser window to authorize access. The vulnerability exploits the assumption that visiting the verification URI implies intent and awareness of the authorization request. By allowing automatic approval based solely on session presence, ZITADEL fails to enforce the principle of least privilege and explicit user consent required by modern security standards for OAuth 2.0 implementations. This flaw undermines the integrity of multi-factor authentication setups if MFA is tied strictly to login rather than granular application authorization events.
To mitigate this vulnerability, organizations must upgrade their ZITADEL instances to version 4.19.5 or later, where the issue has been resolved by enforcing explicit consent requirements for device authorizations regardless of existing session states. Administrators should also review their OIDC client configurations to ensure that sensitive scopes are not inadvertently exposed through less secure flows until patches are applied. Additionally, implementing strict monitoring for unusual patterns in token issuance and verifying that all OAuth clients adhere to the latest security best practices can help detect potential exploitation attempts. Regular audits of authorization logs against known attack vectors associated with CWE-862 will further strengthen the organization's defense posture against similar access control bypasses.