CVE-2026-119128

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.19.4

Description An authentication bypass exists in the Login V2 UI that allows unauthenticated attackers to take over accounts of users who have not yet configured any authentication method. By computing a valid verificationCheck cookie using the user ID and browser fingerprint, an attacker can set a password, register a passkey, or link an identity provider for the target account.

Recommendations Update to version 4.19.5.