Vulnerability details

CVE-2026-119128

zitadel zitadel

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

CVSS 4.0

9.1Critical

Official description

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

CVSS scores

Score	Version	Source	Vector
9.1Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
7.4High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
zitadel	zitadel	4.0.0 ≤ v < 4.19.5	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xv vendor-advisory
https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-login-v2-account-takeover-via-forgeable-verificationcheck-cookie third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-29
Last updated: 2026-11-03
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 19 · Low

Exploit prediction (EPSS)

0.28%

Probability of exploitation in 30 days

21.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-565
Reliance on Cookies without Validation and Integrity Checking