Open-source identity provider ZITADEL has fixed a critical login flaw that could let an attacker with no account take over other users' accounts. The vulnerability, CVE-2026-119128, carries a CVSS score of 9.1 and affects ZITADEL 4.0.0 through 4.19.4. It was published on 29 October 2026, and the fix is version 4.19.5 or later. The flaw sits in the Login V2 interface, which many organisations use to handle sign-ins for their own applications.

How an attacker could seize an account

Login V2 remembered that a user had just verified an email address or invite code using a verificationCheck cookie. That cookie was a SHA-256 hash of the user ID and the browser's fingerprint cookie, values an attacker could learn or control, with no server-side secret involved. Anyone who knew a victim's user ID or login name could therefore compute a valid proof for a user who had no authentication method yet, such as an invited user or one created through the API before first sign-in. With that proof, the attacker could set the victim's password, register a passkey, or link their own external identity account, and then sign in as the victim. Users who already had a password, passkey or identity link are not affected.

What administrators should do

Administrators should upgrade to ZITADEL 4.19.5 or later, which only accepts verification proofs issued by the backend and signed with a server-side secret that expires after five minutes. As a partial mitigation on unpatched systems, every active user should be given an initial credential, so nobody is left without an authentication method. A companion flaw published the same day, CVE-2026-119127, lets attackers poison password-reset and verification links through host-header injection, so the same upgrade covers both issues. ZITADEL says the flaw is not known to be exploited.

Sources: ZITADEL security advisory and StackFlag CVE-2026-119128 record.