CVE-2026-109371

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.17.9

Description The hosted Login V1 UI contains a flaw where the change-username handler processes requests for the account associated with a login flow before verifying any authentication factors. This allows unauthenticated attackers to provide a victim's login name and submit a new username to rename any active human user, including administrators, which results in the users being locked out of their accounts.

Recommendations Update ZITADEL to version 4.18.0 or later.