Live › vulnerability › CVE-2026-119128
ZITADEL's Login V2 UI lets an unauthenticated attacker set the first password, passkey or linked identity provider for a user who has no authentication method yet. The attacker can compute a valid verificationCheck cookie from the user ID and browser fingerprint, which takes over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted or managed ZITADEL 4.0.0 up to but not including 4.19.5 that use the Login V2 UI. The risk is highest for users created without any authentication method, such as accounts provisioned but not yet onboarded. Instances on other versions, or where every user already has a credential, are less exposed.
No product ranges from the sources yet.
zitadel --version where the binary is available.4.19.5 or later, per the NVD entry for the affected range (4.0.0 before 4.19.5).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-119128")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.