{"id":"CVE-2026-119128","kind":"vulnerability","aliases":["CVE-2026-119128"],"related":[],"title":"ZITADEL: unauthenticated attackers take over accounts lacking any login method","description":"ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.","summary":"ZITADEL's Login V2 UI lets an unauthenticated attacker set the first password, passkey or linked identity provider for a user who has no authentication method yet. The attacker can compute a valid verificationCheck cookie from the user ID and browser fingerprint, which takes over the account.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","package","self-hosted","sso","zitadel"],"not_affected_if":["all-users-have-credentials","version-outside-range"],"how_to_check":"- Check the running ZITADEL version, for example by reading the deployed image tag or `zitadel --version` where the binary is available.\n- Look for users in the instance who have no password, passkey or identity provider linked.","fix":"- Move ZITADEL to `4.19.5` or later, per the NVD entry for the affected range (4.0.0 before 4.19.5).","status":"open","published_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:27:49+00:00","updated_at":"2026-10-29T16:27:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:27:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move ZITADEL to `4.19.5` or later, per the NVD entry for the affected range (4.0.0 before 4.19.5).","reach":"internet","title":"ZITADEL: unauthenticated attackers take over accounts lacking any login method","impact":"high","summary":"ZITADEL's Login V2 UI lets an unauthenticated attacker set the first password, passkey or linked identity provider for a user who has no authentication method yet. The attacker can compute a valid verificationCheck cookie from the user ID and browser fingerprint, which takes over the account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zitadel","self-hosted","identity","sso"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over user accounts lacking any authentication method","analyst_note":"Confirm the exact affected range and fixed version against the ZITADEL release notes or GitHub advisory; NVD listing alone was the only source.","how_to_check":"- Check the running ZITADEL version, for example by reading the deployed image tag or `zitadel --version` where the binary is available.\n- Look for users in the instance who have no password, passkey or identity provider linked.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range","all-users-have-credentials"],"who_is_affected":"Teams running self-hosted or managed ZITADEL 4.0.0 up to but not including 4.19.5 that use the Login V2 UI. The risk is highest for users created without any authentication method, such as accounts provisioned but not yet onboarded. Instances on other versions, or where every user already has a credential, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4166,"output_tokens":621,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119128':13A,16A '-2026':12A,15A '4.0.0':72C '4.19.5':74C 'account':6A,70B,129C 'allow':86C 'attack':3A,32B,52B,88C,100C 'authent':48B,77C,98C 'browser':64B,112C 'bypass':78C 'comput':54B,102C 'contain':75C 'cooki':58B,106C 'credenti':93C 'cve':11A,14A 'fingerprint':65B,113C 'first':35B,92C 'host':21B 'id':62B,110C 'ident':17B,40B,124C 'lack':7A,96C 'let':29B 'link':39B,122C 'login':9A,26B,82C 'method':10A,49B,99C 'packag':18B 'passkey':37B,120C 'password':36B,117C 'provid':41B,125C 'regist':118C 'self':20B 'self-host':19B 'set':33B,90C,115C 'sso':22B 'take':4A,67B,126C 'ui':28B,84C 'unauthent':2A,31B,87C 'user':44B,61B,95C,109C 'v2':27B,83C 'valid':56B,104C 'verificationcheck':57B,105C 'vulner':79C 'yet':50B 'zitadel':1A,23B,24B,71C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or managed ZITADEL 4.0.0 up to but not including 4.19.5 that use the Login V2 UI. The risk is highest for users created without any authentication method, such as accounts provisioned but not yet onboarded. Instances on other versions, or where every user already has a credential, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119128","severity":null,"published_at":"2026-10-29T16:18:05+00:00","modified_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}