ZITADEL: Authentication bypass in Login V2 UI via forged session cookie
Summary
ZITADEL 4.0.0 through 4.19.1 and 3.0.0 through 3.4.15 contain a flaw in the Login V2 hosted login UI: the session cookie is neither signed nor validated. An unauthenticated attacker who can reach the login UI and guess a victim's time-ordered session ID can obtain a fresh token for the victim's authenticated session, including sessions where MFA was completed. This can lead to full takeover of an instance administrator account, and the attack depends on timing and on the session ID being guessable.
Affected
- ZITADEL 4.0.0 through 4.19.1 (including RC versions)
- ZITADEL 3.0.0 through 3.4.15 (including RC versions). The 3.x line is end-of-life. Whether 3.x ships Login V2 is not verified.
- Deployments that do not run Login V2 (Login V1 only) are not affected, according to the vendor advisory.
Fixed in
- 4.x: upgrade to 4.19.2 or later (vendor advisory).
- Recommended: 4.19.5 or later, which signs Login V2 session cookies (release notes, not independently verified).
- 3.x: no fix available; upgrade to a patched 4.x release.
Workaround
- No complete workaround on unpatched versions; upgrading is required.
- Partial mitigation: rate limiting requests to the Login UI, for example at a reverse proxy. This does not close the gap.
- Restrict network access to the Login UI where possible.
Exploitation
- No public proof of concept found; status unknown.
- Not marked as known exploited in the sources checked.
- CISA SSVC: exploitation none, not automatable, technical impact total.
- EPSS 0.00423 (low).
Our recommendation
- Upgrade to 4.19.5 or later, at minimum 4.19.2.
- After the upgrade, set ZITADEL_SESSION_COOKIE_SECRET (at least 32 characters).
- Inform users that they must sign in to the Login UI again after the upgrade.
- Check whether the Login V2 UI is reachable from the internet and restrict or rate-limit access.
- Review recent administrator sign-ins for anomalies.
- Priority: high for self-hosted instances with Login V2 exposed to the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-jh92-5mrj-p2w2 github.com
- VulnCheck advisory for CVE-2026-109373 www.vulncheck.com
- ZITADEL releases github.com
- OSV entry CVE-2026-109373 osv.dev
- Strix CVE record CVE-2026-109373 www.strix.ai
- Threatint CVE record CVE-2026-109373 cve.threatint.com
- VulDB entry 417164 vuldb.com
- HOL Guard CVE summary CVE-2026-109373 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:42.
Original description (NVD)
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.