CVE-2026-109371: ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ZITADEL versions from 3.0.0 before 4.18.0 are affected where the hosted Login V1 UI is in use. The issue targets active human-user accounts, including administrator accounts.
What does an attacker need to exploit this?
An attacker needs only the victim's login name. No authentication, verified login factor, user interaction, or elevated privileges are required.
What is the practical impact of a successful attack?
An attacker can change the username of an active human user, including an administrator. This can lock the legitimate user out of their account.
How can defenders determine whether an account may have been targeted?
Review username-change activity for unexpected renames of active human users, particularly administrator accounts. The provided information does not identify a specific log event or indicator beyond unauthorized username changes.