CVE-2026-119128 | BDVDB-2026-397884 Detail
zitadelzitadel
Description#
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.