CVE-2026-109373: ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZITADELto a version that resolves this vulnerability.Fixed in 4.19.2
Event History
Frequently Asked Questions
Which deployments are affected?
ZITADEL versions from 3.0.0 up to, but not including, 4.19.2 are affected. The issue is in the Login V2 UI.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to guess time-ordered session IDs around a victim's sign-in and submit forged unsigned session cookies with empty tokens.
What is the practical impact of a successful attack?
A successful attacker can receive rotated session tokens for another user and take over that user's account. This includes administrator sessions after MFA has been completed.
How can I tell whether an attack may be possible against my environment?
An environment may be exposed if it runs an affected ZITADEL version and uses the Login V2 UI. The provided information does not include indicators or logs that would confirm prior exploitation.