CVE-2026-119129
Deferred Deferred - Pending Action

Missing Authorization in ZITADEL Login V2

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119129
EUVD
EUVD-2026-113196

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zitadel zitadel 4.0.0
zitadel zitadel 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119129 is a missing authorization flaw in ZITADEL's Login V2 and OIDC device authorization API. It allows attackers to approve OAuth 2.0 device authorizations for a victim's account without their consent by exploiting an active session. Attackers send a link with their user code to a logged-in victim, who then unknowingly approves the attacker's device authorization, granting the attacker access to the victim's tokens and bypassing project access restrictions.

Detection Guidance

To detect this vulnerability, check ZITADEL versions running on your systems. Affected versions are 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5. Inspect logs for unusual OAuth 2.0 device authorization approvals without user consent. Look for API calls to the OIDC device authorization endpoint that bypass normal consent flows.

Impact Analysis

This vulnerability can lead to account takeover, allowing attackers to gain full API access as the victim, including administrative privileges if the victim is an admin. Attackers can bypass project access settings and obtain tokens without the victim's knowledge or interaction beyond opening a malicious link in a browser with an active session. The impact includes unauthorized access to sensitive data and potential full control over the victim's ZITADEL account.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to personal or protected health information. GDPR requires strict access controls and user consent, which this flaw bypasses. HIPAA mandates safeguards to protect sensitive health data, which could be compromised through unauthorized token access. Organizations using affected ZITADEL versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade ZITADEL to version 4.19.5 or later immediately. If using ZITADEL 3.x, upgrade to a supported 4.x release as 3.x is end-of-life. As a temporary workaround, disable the Device Code grant type in applications if the flow is unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart