CVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
The issue affects users who do not yet have any authentication method configured. An attacker can set that user's first credential and then take over the account.
What does an attacker need to exploit this?
Exploitation is unauthenticated and requires the target user's ID and browser fingerprint, which are used to compute a valid verificationCheck cookie. The attack complexity is rated high.
What types of credentials could an attacker add?
An attacker can set a password, register a passkey, or link an identity provider as the user's first authentication method.
Which versions are affected?
ZITADEL versions from 4.0.0 through versions before 4.19.5 are affected. Version 4.19.5 is not included in the affected range.