{"id":"CVE-2026-119128","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-119128","generatedAt":"2026-11-04T11:56:53.408Z","title":"ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method.","description":"ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.","published":"2026-10-29T16:18:06.000Z","lastModified":"2026-11-03T16:17:21.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":9.1,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-565"],"affected":[],"epss":{"score":0.00285,"percentile":0.2107,"date":"2026-11-03","history":[{"date":"2026-10-30","score":0.00285,"percentile":0.2103}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-29T16:18:06.000Z","detail":{"score":"9.1","severity":"CRITICAL","publishedAt":"2026-10-29T16:18:05.643Z"},"summary":"New CVE, critical severity (CVSS 9.1)."}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-login-v2-account-takeover-via-forgeable-verificationcheck-cookie","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-119128","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}