PT-2026-110786

CVE-2026-109373

Published

2026-10-12

Updated

2026-10-16

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.19.1

Description An authentication bypass exists in the Login V2 UI. Unauthenticated attackers can obtain session tokens of other users by forging unsigned session cookies. By guessing time-ordered session IDs associated with a victim's sign-in and providing empty tokens, attackers can receive rotated tokens. This allows for full account takeover, including sessions for administrators that have already completed Multi-Factor Authentication (MFA), a security process requiring two or more verification factors.

Recommendations Update ZITADEL to version 4.19.2 or later.

Exploitability

Exploit

Fix

Researchers

Livio-A

Lucasdodgson

Vendors

Affected products

Weakness enumeration

CWE-441: Unintended Proxy or Intermediary (\'Confused Deputy\')

Related identifiers