CVE-2026-119128
Deferred Deferred - Pending Action

Authentication Bypass in ZITADEL Login V2 UI

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119128
EUVD
EUVD-2026-113195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zitadel zitadel 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119128 is an authentication bypass flaw in ZITADEL versions 4.0.0 through 4.19.4 affecting the Login V2 UI. Unauthenticated attackers can forge a verificationCheck cookie using a user's ID and browser fingerprint to set the first credential for users without existing authentication methods, enabling account takeover.

Detection Guidance

Detecting this vulnerability requires checking if your ZITADEL instance is running a vulnerable version (4.0.0 to 4.19.4). Use commands like 'zitadel version' or check your deployment logs for version details. Monitor for unusual account activities such as unexpected password resets or passkey registrations.

Impact Analysis

Attackers can take over user accounts by setting passwords, registering passkeys, or linking identity providers. This grants full access to the account, including permissions and applications using ZITADEL for authentication. Users without any prior authentication method are most vulnerable.

Mitigation Strategies

Immediately upgrade ZITADEL to version 4.19.5 or later to patch the vulnerability. There are no configuration workarounds; upgrading is the only mitigation. Verify the upgrade by checking the version and testing account access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart