CVE Alert: CVE-2026-119128 – zitadel

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

**Risk verdict:** Treat as a high-priority identity-system exposure; active exploitation is unconfirmed because KEV, SSVC, PoC and EPSS data were not supplied.

**Why this matters:** Successful exploitation could give an attacker control of an account that has not yet enrolled an authentication method, enabling access to data and actions available to that identity. The practical impact depends on whether such accounts can reach sensitive applications or hold elevated permissions.

**Most likely attack path:** The service must be network-accessible, and the target account must meet the vulnerable enrolment condition; no prior privileges or user action are required. High attack complexity and a stated attack requirement mean exploitation is not necessarily indiscriminate, while unchanged scope suggests impact is confined to the compromised account unless its access enables further actions.

**Who is most exposed:** Organisations using self-hosted identity platforms with Login V2 enabled and allowing users to enrol their first authentication method are most exposed. Pay particular attention to newly created, invited or partially enrolled accounts.

Alert on unauthenticated first-time password, passkey or identity-provider enrolment.

Review authentication-method additions followed by new-device or unusual-location sign-ins.

Inspect logs for repeated verification failures or unexpected verification-cookie patterns.

Identify accounts with no enrolled authentication method and check for recent changes.

Mitigation and prioritisation:

Upgrade promptly to the vendor’s fixed release; confirm all identity-service instances are covered.

Temporarily restrict first-method enrolment to trusted networks or authenticated, verified workflows.

Review and validate recent authentication-method changes, especially for privileged accounts.

Test the change in staging, then monitor enrolment and sign-in rates during rollout.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.