ZITADEL: Account takeover in Login V2 via forgeable verificationCheck cookie
Summary
ZITADEL's hosted Login V2 UI trusts a verificationCheck cookie that is derived only from the user ID and the browser fingerprint, so it can be computed by anyone. An unauthenticated attacker who knows the user ID or login name of an active user without any authentication method can set that user's first password, register a passkey, or link an external identity provider, and then sign in as that user. Users who already have a password, passkey or identity provider link are not affected, and the ZITADEL APIs are not affected.
Affected
- ZITADEL 4.0.0 through 4.19.4 (including RC versions)
- Only deployments that serve the Login V2 UI
Fixed in
- Upgrade to ZITADEL 4.19.5 or later
Workaround
- No configuration fully closes the gap on unpatched versions.
- Partial mitigation: create users with an initial credential so that no active user is left without an authentication method.
Exploitation
Unknown. The advisory describes the attack method in detail, but no public exploitation has been reported in the sources.
Our recommendation
- Upgrade ZITADEL to 4.19.5 or later.
- After patching, set ZITADEL_SESSION_COOKIE_SECRET to a random value of at least 32 characters.
- Until patched, give every user an initial credential and review users who have no authentication method, such as invited or API-created accounts.
- Monitor logins and credential changes for unexpected password, passkey or identity provider changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-84fg-x5h4-w8xv github.com
- VulnCheck advisory CVE-2026-119128 www.vulncheck.com
- ZITADEL security advisories github.com
- ZITADEL releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:12.
Original description (NVD)
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.