www.vulncheck.com ZITADEL Vulnerabilities CVE-2026-119127 and CVE-2026-119128 Expose Accounts to Takeover
Article Content
- •CVE-2026-119127 allows account takeover via host header injection.
- •CVE-2026-119128 enables authentication bypass for accounts without authentication methods.
- •Both vulnerabilities affect ZITADEL versions prior to 4.19.5 and require immediate patching.
ZITADEL versions 4.0.0 to 4.19.5 have two vulnerabilities: CVE-2026-119127 allows unauthenticated attackers to exploit host header injection, while CVE-2026-119128 enables authentication bypass for accounts without an authentication method. Both vulnerabilities were published on 2026-10-29, with CVE-2026-119128 rated as CVSS 9.1 () and CVE-2026-119127 rated as CVSS 8.6 (High). Attackers can take over accounts by manipulating recovery links or setting initial credentials. Organizations using ZITADEL for identity management, especially those with administrator accounts, are at risk. No active exploitation has been confirmed yet, but urgent patching is recommended. The vendor has released updates to address these vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track Zitadel and CVE-2026-119127 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVSS scores for these vulnerabilities?
Who is most at risk from these vulnerabilities?
What should organizations do to protect themselves?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom…