Live › vulnerability › CVE-2026-119129
ZITADEL's Login V2 approves OAuth 2.0 device authorizations using a victim's existing session without asking for consent. An attacker who sends a signed-in user a link with the attacker's user code can obtain that user's tokens, and can bypass project access settings through the OIDC device authorization API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams that self-host or operate ZITADEL as their identity provider with Login V2 and the OAuth 2.0 device authorization flow. Instances on versions before the fixed ranges are exposed; instances outside the affected ranges can skip it. Sources do not say whether the device flow must be enabled by default.
No product ranges from the sources yet.
4.19.5.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
This page as .md · .json · in your agent: get_signal("CVE-2026-119129")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.