CVE-2026-109373
Deferred Deferred - Pending Action

Authentication Bypass in ZITADEL Login V2 UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109373
EUVD
EUVD-2026-97671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zitadel zitadel 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in ZITADEL 3.0.0 before 4.19.2. It allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, enabling account takeover even for sessions with MFA.

Impact Analysis

If you use ZITADEL versions 3.0.0 to 4.19.1, attackers could hijack your account by stealing session tokens. This includes administrator sessions even with MFA enabled. Attackers can gain full control over your account, access sensitive data, and perform actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality and integrity of sensitive information.

Mitigation Strategies

Upgrade ZITADEL to version 4.19.2 or later to address the authentication bypass vulnerability in the Login V2 UI.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart