CVE-2026-109371 Details
Description
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
A missing authentication vulnerability has been identified in ZITADEL versions 3.0.0 prior to 4.18.0, specifically within the hosted Login V1 user interface. The vulnerability allows unauthenticated attackers to change the usernames of active human users, including administrators, by exploiting the change-username handler. This handler processes requests based on the login flow before verifying any authentication factors. As a result, attackers can submit a victim's login name and request a username change, effectively locking the victim out of their account.
Users are advised to upgrade to ZITADEL version 4.19.1. Note that the 3.x release line is no longer supported and also requires an upgrade to a patched 4.x version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.17.3 (semver) >= 3.0.0, <= 3.4.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |