Paper/Archive/CVE-2026-109373

CVE-2026-109373

zitadel zitadel — ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 36.5.365 × 207.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

Affected

ProductAffectedFixed inSource

zitadel3.0.0 – < 4.19.24.19.2CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/zitadel/zitadel/security/advisories/GHSA-jh92-5mrj-p2w2 writeupvulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-unsigned-login-v2-session-cookie