All vulnerabilities
CVE-2026-109373GHSA-jh92-5mrj-p2w2

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

zitadel zitadel
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.19.2Fixed versionCVE List
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

Text from CVE List

Affected versions 2

  • zitadelaffected: 3.0.0 before 4.19.2CVE List
  • zitadelunaffected: 4.19.2CVE List

References 2