Vulnerability details

CVE-2026-119129

zitadel zitadel

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

CVSS 4.0

8.6High

Official description

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
zitadel	zitadel	3.0.0 ≤ v ≤ 3.4.15	CVEProject cvelistV5 (CNA)
zitadel	zitadel	4.0.0 ≤ v < 4.19.5	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/zitadel/zitadel/security/advisories/GHSA-qj3q-235g-qr6w vendor-advisory
https://www.vulncheck.com/advisories/zitadel-3.0.0-through-3.4.15-and-4.0.0-before-4.19.5-account-takeover-via-device-authorization-approval third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-29
Last updated: 2026-10-29
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.28%

Probability of exploitation in 30 days

20.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-862
Missing Authorization