External risk intelligence

ZITADEL Login V2 Authentication Bypass Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-119128

ZITADEL is an identity management and authentication platform designed to be exposed to the internet to facilitate user login, registration, and identity verification. As a public-facing authentication service, it is intended to handle external traffic by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the ZITADEL login interface could allow unauthorized individuals to bypass authentication controls. This flaw enables an attacker to potentially take over user accounts by setting initial credentials or linking identity providers without proper verification. The main concern is confirming relevance and exposure within our environment.

Attackers can bypass login to control user accounts.
It affects user account security and identity management.
Confirm if ZITADEL is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on ZITADEL's Login V2 UI to take over user accounts. This is possible because the system allows unauthenticated users to set the initial credentials for accounts that don't have any authentication methods defined. By calculating a valid `verificationCheck` cookie using a user's ID and browser information, an attacker can then establish a password, link a passkey, or connect an identity provider to the account.

Requires external network access.
Computes a cookie to bypass login.
Leads to full account takeover.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized control over user accounts by bypassing the normal login process. This is possible when the Login V2 UI is in use and allows an unauthenticated attacker to compute a valid `verificationCheck` cookie. This cookie can then be used to set a user's password, register a passkey, or link an identity provider, effectively taking over the account.

User account access.
Bypassing authentication via forged cookie.
Complete account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ZITADEL platform's authentication bypass vulnerability likely falls under the purview of the Identity and Access Management (IAM) platform team or the application owners responsible for ZITADEL's deployment and operation. The first practical step is to identify all ZITADEL instances, determine their exposure and criticality, locate the accountable owners, and then prioritize remediation efforts.

Identify ZITADEL instances and ownership.
Verify public-facing and critical deployments.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ZITADEL?

ZITADEL is an identity management and authentication platform. It functions as a central hub for handling user logins, registrations, and account security. Organizations use it to manage user identities across their applications, acting as the gateway that verifies who a person is before they gain access to protected systems.

How does CVE-2026-119128 work?

This vulnerability is classified as CWE-565, which relates to reliance on a component that can be influenced by an untrusted source. In this case, the ZITADEL Login V2 UI improperly validates a verification cookie. An attacker can forge this cookie using a user's ID and browser fingerprint to impersonate the system's verification process, allowing them to take over accounts that lack established credentials.

What triggers this authentication bypass?

The flaw is triggered when an attacker interacts with the Login V2 UI to target an account that currently has no authentication methods configured. It does not affect accounts that have already secured their identity with a password or passkey. Success depends on the attacker's ability to accurately calculate the required verification cookie.

Why is this CVE relevant to my infrastructure?

According to Halo Surface Signal, ZITADEL is designed as an internet-facing service to facilitate global user logins. Because it is intended to handle traffic from the public web, any instance exposed to the internet is highly likely to be reachable by an attacker. Internal-only instances have a lower profile but still warrant review if they are reachable from untrusted network segments.

How should I respond to this threat?

Your first step is to catalog every instance of ZITADEL running in your environment to understand your total footprint. Once identified, verify which instances are using the affected Login V2 UI and confirm if they are exposed to the internet. Prioritize updating these specific instances to version 4.19.5 or later to eliminate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.