CVE-2026-119128

ZITADEL versions 4.0.0 before 4.19.5 are susceptible to an authentication bypass vulnerability in the Login V2 UI . The root cause is the ability for unauthenticated attackers to compute a valid verificationCheck cookie using only the user ID and browser fingerprint. This flaw allows attackers to...

CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser...