Read the docs
TI-2026-82647 Aliases CVE-2026-119129GHSA-4j7m-6fr6-j463

ZITADEL Login V2 flaw lets attackers approve device authorizations

Priority MEDIUM 45CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contain a missing authorization flaw in Login V2 (CWE-862). Attackers can approve OAuth 2.0 device authorizations using a victim's existing session without consent. A signed-in user who opens an attacker's link can have tokens obtained for the attacker, and project access settings can be bypassed through the OIDC device authorization API.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 4.19.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadel4.0.0 to before 4.19.54.19.5Patch availableCNA
zitadelzitadel3.0.0 – 3.4.15—No fix listedCNA
  • zitadel Vendorzitadel Affected 4.0.0 to before 4.19.5 Fixed in 4.19.5 Patch available CNA
  • zitadel Vendorzitadel Affected 3.0.0 – 3.4.15 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*——zitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions — — ·zitadel

Remediation

Upgrade to ZITADEL 4.19.5, the fix for the 4.0.0 before 4.19.5 range. No fixed version is listed for ZITADEL 3.0.0 through 3.4.15.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA zitadel (zitadel) Fixed in 4.19.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zitadel 4.19.5

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-82646 Authentication bypass in ZITADEL Login V2 enables account takeoverPriority MEDIUM 41
    • TI-2026-82645 Host header injection in ZITADEL Login V2 enables account takeoverPriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119129
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Alias added: GHSA-4j7m-6fr6-j463

References

Advisory 1

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2026-67551 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback CVSS 4.0CRITICAL 9.3
  • TI-2026-67543 ZITADEL before 4.17.3 Account Takeover via External IdP Linking CVSS 4.0CRITICAL 9.3
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2026-71183 Missing authentication in ZITADEL Login V1 lets attackers rename users CVSS 4.0HIGH 8.8
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences