{"id":"CVE-2026-109373","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-109373","generatedAt":"2026-10-28T01:11:56.191Z","title":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies.","description":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.","published":"2026-10-12T17:17:35.000Z","lastModified":"2026-10-13T17:17:28.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":9.2,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-441"],"affected":[],"epss":{"score":0.00423,"percentile":0.36332,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00423,"percentile":0.34821}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T17:17:35.000Z","detail":{"score":"9.2","severity":"CRITICAL","publishedAt":"2026-10-12T17:17:35.110Z"},"summary":"New CVE, critical severity (CVSS 9.2)."}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-jh92-5mrj-p2w2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-unsigned-login-v2-session-cookie","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109373","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}