CVE-2026-119129: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to send a signed-in ZITADEL user a link containing the attacker’s OAuth 2.0 device user code. If the victim follows the link while their existing session is active, the attacker can obtain the victim’s tokens without the victim’s consent.
Are unauthenticated attackers able to start the attack?
Yes. The vector is network-accessible and requires no attacker privileges, although successful exploitation requires user interaction from a victim who has an existing signed-in session.
Which deployments are affected?
Affected versions are ZITADEL 3.0.0 through 3.4.15 and ZITADEL 4.0.0 before 4.19.5. The issue is in Login V2 and involves the OIDC device authorization API.
Can project access settings prevent exploitation?
No. The vulnerability description states that attackers can bypass project access settings through the OIDC device authorization API.