PT-2026-132359

CVE-2026-119128

Published

2026-10-29

Updated

2026-10-30

Description by

CVSS 4.0

9.1

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.19.4

Description An authentication bypass exists in the Login V2 UI that allows unauthenticated attackers to take over accounts of users who have not yet configured any authentication method. By computing a valid verificationCheck cookie using the user ID and browser fingerprint, an attacker can set a password, register a passkey, or link an identity provider for the target account.

Recommendations Update to version 4.19.5.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products