CVE-2026-109373

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.19.1

Description An authentication bypass exists in the Login V2 UI. Unauthenticated attackers can obtain session tokens of other users by forging unsigned session cookies. By guessing time-ordered session IDs associated with a victim's sign-in and providing empty tokens, attackers can receive rotated tokens. This allows for full account takeover, including sessions for administrators that have already completed Multi-Factor Authentication (MFA), a security process requiring two or more verification factors.

Recommendations Update ZITADEL to version 4.19.2 or later.