---
id: "CVE-2026-119128"
kind: "vulnerability"
aliases: ["CVE-2026-119128"]
title: "ZITADEL: unauthenticated attackers take over accounts lacking any login method"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["identity", "package", "self-hosted", "sso", "zitadel"]
not_affected_if: ["all-users-have-credentials", "version-outside-range"]
published_at: "2026-10-29T16:18:05+00:00"
first_seen_at: "2026-10-29T16:25:58+00:00"
updated_at: "2026-10-29T16:27:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119128", "first_seen_at": "2026-10-29T16:25:58+00:00"}]
---

# ZITADEL: unauthenticated attackers take over accounts lacking any login method

ZITADEL's Login V2 UI lets an unauthenticated attacker set the first password, passkey or linked identity provider for a user who has no authentication method yet. The attacker can compute a valid verificationCheck cookie from the user ID and browser fingerprint, which takes over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running ZITADEL version, for example by reading the deployed image tag or `zitadel --version` where the binary is available.
- Look for users in the instance who have no password, passkey or identity provider linked.

## Fix

- Move ZITADEL to `4.19.5` or later, per the NVD entry for the affected range (4.0.0 before 4.19.5).

## Timeline

- 2026-10-29T16:25:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119128

## From the sources

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_