CVE-2026-109373— ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
Quick assessment
Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ZITADEL 3.0.0 至 4.19.2（不含 4.19.2）版本中，Login V2 UI 存在一个身份验证绕过漏洞。该漏洞允许未经身份验证的攻击者通过伪造未签名的会话Cookie，获取其他用户的会话令牌。攻击者可以在受害者登录时，猜测其前后时间顺序排列的会话ID，并附带空的令牌发送请求，从而接收到旋转后的新令牌，进而接管用户账户，甚至包括已完成多因素认证（MFA）的管理员会话。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109373
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109373
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109373
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109373 (2)
Same Patch Batch · zitadel · 2026-10-12 · 4 CVEs total
| CVE-2026-109372 | 8.7 HIGH | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion |
| CVE-2026-109371 | 8.2 HIGH | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 |
| CVE-2026-109374 | 5.5 MEDIUM | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation |
IV. Related Vulnerabilities
Same product: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identi -
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same vendor: zitadel
-
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC To -
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identi -
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change -
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Veri -
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged Exter
Same weakness: CWE-441
-
CVE-2026-70148
Windows Broadcast DVR User Service Information Disclosure Vu -
CVE-2026-83837
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerabi -
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-106487
Backstage: Unsupported catalog cluster authentication mode i -
CVE-2026-106462
Backstage: Scaffolder credential handling may allow unintend
V. Comments for CVE-2026-109373
No comments yet