GHSA-84fg-x5h4-w8xv: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

Published Oct 29, 2026

Updated

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

Event History

Oct 29, 2026

CVE Published

via OSV·03:58 PM

Data Sourced

via OSV·03:58 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which accounts are exposed to takeover?

Users who lack any authentication method are exposed. An unauthenticated attacker can set that account’s first credential and take control of it.

What does an attacker need to exploit this issue?

The attacker needs the target user ID and the browser fingerprint needed to compute a valid verificationCheck cookie. No existing account privileges or user interaction are required.

What account access can an attacker establish?

An attacker can set a password, register a passkey, or link an identity provider as the user’s first authentication method. Any of these actions can enable account takeover.

Which versions are affected?

ZITADEL versions from 4.0.0 before 4.19.5 are affected.

GHSA-84fg-x5h4-w8xv: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

Event History

Frequently Asked Questions

Which accounts are exposed to takeover?

What does an attacker need to exploit this issue?

What account access can an attacker establish?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which accounts are exposed to takeover?

What does an attacker need to exploit this issue?

What account access can an attacker establish?

Which versions are affected?