CVE-2026-119129

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.15 ZITADEL versions 4.0.0 through 4.19.4

Description Login V2 contains a missing authorization issue that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without their consent. By sending a signed-in user a link containing the attacker's user code, an attacker can obtain the victim's tokens and bypass project access settings via the OIDC device authorization API.

Recommendations Update ZITADEL versions 3.0.0 through 3.4.15 to a version where this issue is resolved. Update ZITADEL versions 4.0.0 through 4.19.4 to version 4.19.5 or later.