CVE-2026-29193
Authentication Bypass in ZITADEL Login V2 UI Enables Unauthorized Access
Publication date: 2026-03-07
Last updated on: 2026-03-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 4.0.0 (inc) to 4.12.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-29193 is a high-severity vulnerability in Zitadel versions 4.0.0 through 4.12.0 affecting the Login V2 user interface.
The flaw allows attackers to bypass configured login behaviors and security policies set by organization administrators, such as disabling user self-registration or enforcing passwordless login methods.
Due to improper enforcement on the login UI server, an attacker can send direct HTTP requests to create new accounts or authenticate using username and password even when these options are disabled.
This results in unauthorized system access.
The issue was fixed in Zitadel version 4.12.1 by properly enforcing security policies on the login UI server.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to your Zitadel identity management system.
Attackers can bypass security policies to self-register new accounts or sign in using passwords even if these options are disabled by your organization.
Such unauthorized access can compromise the confidentiality of sensitive information managed by Zitadel.
The vulnerability has a high confidentiality impact but low integrity and no availability impact.
To mitigate this risk, upgrading to Zitadel version 4.12.1 or later is recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Zitadel to version 4.12.1 or later.
This update enforces the security policies properly on the login UI server, preventing unauthorized self-registration and login bypass.