CVE-2026-119128 Details

An authentication bypass vulnerability has been identified in ZITADEL versions 4.0.0 prior to 4.19.5, specifically within the Login V2 user interface. This vulnerability allows unauthenticated attackers to manipulate the first credential of users who do not have any authentication method established. Attackers can generate a valid verificationCheck cookie using the user ID and browser fingerprint, enabling them to set a password, register a passkey, or link an identity provider, thereby taking over the user's account. The issue affects active users who have not yet set a password, passkey, or linked an identity provider, such as invited users or those created through the API before their first sign-in.

Users can upgrade to ZITADEL version 4.19.5 or later, where this vulnerability has been patched. For deployments using the Login V2 UI, ensure that the ZITADEL_SESSION_COOKIE_SECRET is set to a randomly generated value of at least 32 characters. If this secret is not set, Login V2 will derive the key from the configured API credential.