External risk intelligence

ZITADEL Login V2 Authentication Bypass Allows Session Token Theft

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-109373

ZITADEL is an identity and access management (IAM) solution designed to be deployed as an internet-facing service for authentication, user management, and single sign-on. As an identity provider, it acts as a public-facing gateway for user logins, making it a critical, network-exposed component by design in nearly all typical deployments.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in ZITADEL's login interface could allow attackers to bypass authentication and take over user accounts by forging session cookies. This affects systems using ZITADEL for identity and access management, potentially impacting any user or administrator with an active session. The primary concern is confirming if your organization uses the affected technology and is exposed.

Unauthenticated attackers can take over accounts.
Compromises user sessions, including administrators.
Confirm relevance and exposure to ZITADEL.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could begin by interacting with the ZITADEL Login V2 UI, which is typically exposed to the internet. By guessing session IDs around a victim's login time and providing empty tokens, the attacker can forge unsigned session cookies, leading to the theft of session tokens and the potential takeover of user accounts, including administrator accounts with multi-factor authentication enabled.

Requires network access to the UI.
Forges unsigned session cookies.
Leads to unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to take over user accounts, including administrator accounts that have multi-factor authentication enabled. Attackers can achieve this by forging unsigned session cookies, enabling them to obtain other users' session tokens when session IDs are predictable.

User session tokens and access.
Forging session cookies and predicting IDs.
Account takeover and unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects ZITADEL deployments, placing responsibility on platform or infrastructure teams managing the identity solution, in coordination with security and application owners. The immediate first step is to identify all instances of ZITADEL, determine their exposure and criticality, and locate the accountable teams for assessment and remediation planning.

Identify ZITADEL instances and owners.
Verify reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ZITADEL?

ZITADEL is an identity and access management (IAM) platform. Organizations use it to handle authentication, user directory management, and single sign-on (SSO) for their applications. It serves as a centralized gateway that verifies user identities before granting access to other systems, making it a foundational component for managing secure user sessions.

How does CVE-2026-109373 function?

This vulnerability is classified as Unacceptable Input Handling or unauthorized proxying (CWE-441). In the Login V2 interface, the system fails to properly validate session cookies. Because these cookies are unsigned, an attacker can manipulate them to impersonate legitimate users and hijack their active sessions, effectively bypassing the platform's security controls.

What triggers the session theft in ZITADEL?

An attacker must be able to interact with the ZITADEL Login V2 UI over the network. They trigger the flaw by predicting session IDs generated near the time of a target's login. Providing an empty token alongside a guessed ID allows them to trick the system into rotating their request into a valid, authenticated session. It does not trigger if the UI is inaccessible or if session ID generation cannot be observed or predicted.

Is my ZITADEL instance at risk?

According to Halo Surface Signal, ZITADEL is designed as an identity provider, meaning it is almost always deployed as an internet-facing service to facilitate logins. Because this flaw allows for complete account takeover—including administrator accounts protected by multi-factor authentication—any instance reachable from the public internet should be treated as highly relevant.

What should I do to address this ZITADEL issue?

The priority is to identify all running ZITADEL instances in your environment and determine which ones utilize the Login V2 UI. Once mapped, coordinate with your infrastructure and security teams to assess the version currently deployed. If you are running a version earlier than 4.19.2, prioritize upgrading to a patched release to eliminate the underlying flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.