ZITADEL Login V2: Missing authorization when approving device authorizations
Summary
ZITADEL Login V2 approves OAuth 2.0 device authorizations with the browser's existing signed-in session, without asking for consent or requiring the user code shown on the device. An attacker who starts a device authorization and gets a signed-in user to open one link can receive that user's tokens, including API access with the ZITADEL project scope. The same missing check allows bypassing project access settings through the OIDC device authorization API.
Affected
- ZITADEL 4.0.0 to before 4.19.5 (including RC versions)
- ZITADEL 3.0.0 through 3.4.15 (including RC versions)
- Only instances with an application that uses the Device Code grant type can be attacked.
Fixed in
- ZITADEL 4.19.5 and later
- The 3.x release line reached end of life on 2026-08-31 and will not receive a fix.
Workaround
- No configuration fully closes the gap on unpatched versions.
- If the Device Authorization flow is not used, remove the Device Code grant type from all applications, which prevents both attack vectors.
Exploitation
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- No public exploitation is documented in the sources.
Our recommendation
- Upgrade ZITADEL 4.x instances to 4.19.5 or later.
- Plan the migration of any 3.x deployment to a patched 4.x release, as 3.x will not be fixed.
- Until patched, remove the Device Code grant type from applications that do not need it.
- Review logs for unexpected device authorizations and token issuance for administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qj3q-235g-qr6w github.com
- VulnCheck advisory: ZITADEL Account Takeover via Device Authorization Approval www.vulncheck.com
- ZITADEL release v4.19.5 github.com
- ZITADEL documentation: Login UI device authorization zitadel.com
- VulDB entry for CVE-2026-119129 vuldb.com
- NVD mirror (threatint) for CVE-2026-119129 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:47.
Original description (NVD)
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.