CVE-2026-109371
Deferred Deferred - Pending Action

Missing Authentication in ZITADEL Login V1 UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109371
EUVD
EUVD-2026-97669

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zitadel zitadel 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication issue in ZITADEL versions 3.0.0 before 4.18.0. The Login V1 UI allows unauthenticated attackers to rename any active human user, including administrators, by submitting a victim's login name and then posting a new username. This happens before any factor verification, enabling attackers to lock users out of their accounts.

Detection Guidance

Check ZITADEL versions before 4.18.0 for the vulnerability. Inspect login flow handlers for unauthenticated username change requests. Monitor logs for unusual username modification events.

Impact Analysis

Unauthenticated attackers could rename your account, including administrators, locking you out of your ZITADEL account. This could lead to loss of access to critical services, data, or administrative controls. The impact is high as it affects all active human users.

Compliance Impact

This vulnerability could lead to unauthorized access or loss of user account control, potentially violating GDPR's data protection requirements or HIPAA's access controls. Organizations using affected ZITADEL versions may face compliance risks due to the lack of authentication and potential data exposure.

Mitigation Strategies

Upgrade ZITADEL to version 4.18.0 or later immediately. Disable the Login V1 UI if possible. Implement strict access controls and monitor for unauthorized username changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart