CVE-2026-109373 Details
Description
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
An authentication bypass vulnerability has been identified in ZITADEL versions 3.0.0 prior to 4.19.2, specifically within the Login V2 user interface. This vulnerability allows unauthenticated attackers to obtain session tokens of authenticated users by forging unsigned session cookies. Exploitation involves guessing session IDs based on the timing of user sign-ins, and using empty tokens to request new tokens from the session API. This could lead to unauthorized access to user accounts, including those of administrators who have completed multi-factor authentication.
Users are advised to upgrade to ZITADEL version 4.19.2 or later. For those on the 3.x release line, which has reached end-of-life, upgrading to a patched 4.x release is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 3.0.0, < 4.19.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |