Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119128— ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

Quick assessment

Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZITADEL 4.0.0 至 4.19.5 之前的版本中，Login V2 用户界面存在身份验证绕过漏洞。该漏洞允许未认证的攻击者为没有任何身份验证方法的用户设置首个凭证。攻击者能够根据用户 ID 和浏览器指纹计算出有效的 verificationCheck Cookie，从而设置密码、注册通行密钥（passkey）或关联身份提供商，进而接管用户账户。

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119128

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在信任Cookie未进行验证与完整性检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zitadel zitadel 4.0.0 ~ 4.19.5 -

II. Public POCs for CVE-2026-119128

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119128

请登录查看更多情报信息。

Other References for CVE-2026-119128 (2)

Same Patch Batch · zitadel · 2026-10-29 · 3 CVEs total

CVE-2026-119127 8.1 HIGH ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
CVE-2026-119129 8.1 HIGH ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authoriza

IV. Related Vulnerabilities

Same product: zitadel
Same vendor: zitadel
Same weakness: CWE-565