CVE-2026-109371— ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
Quick assessment
Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ZITADEL 3.0.0 至 4.18.0 版本之前的托管版 Login V1 UI 中存在一个缺失身份认证的漏洞。在该漏洞中，变更用户名（change-username）处理程序在任一认证因子（factor）通过验证之前，即可对绑定到登录流程的账户执行操作。未经身份验证的攻击者可以提交受害者的登录名，随后通过 POST 请求提交新的用户名，从而将任何活跃的人类用户（包括管理员）的账号重命名，导致其被锁定在账户之外。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109371
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109371
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109371
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109371 (2)
Same Patch Batch · zitadel · 2026-10-12 · 4 CVEs total
| CVE-2026-109372 | 8.7 HIGH | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion |
| CVE-2026-109373 | 8.1 HIGH | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie |
| CVE-2026-109374 | 5.5 MEDIUM | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation |
IV. Related Vulnerabilities
Same product: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Lo -
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identi -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same vendor: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Lo -
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identi -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same weakness: CWE-306
-
CVE-2026-87689
Metasploit Framework Web Service REST API Missing Authentica -
CVE-2026-109571
Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated He -
CVE-2026-109570
Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notific -
CVE-2026-109575
CVE-2026-109575 -
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote ag
V. Comments for CVE-2026-109371
No comments yet