Missing Authentication Vulnerability in ZITADEL Hosted Login UI
CVE-2026-109371

8.8HIGH

Key Information:

Vendor

Zitadel

Status
Zitadel
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109371?

ZITADEL versions prior to 4.18.0 have a vulnerability in the hosted Login V1 UI, allowing unauthenticated users to exploit the change-username handler. This flaw permits an attacker to bypass the verification of authentication factors, enabling them to submit a new username for any account linked to an active login flow. Such an exploit can lock out legitimate users, including administrators, heightening the risk of unauthorized access and account takeover.

Affected Version(s)

zitadel 3.0.0 < 4.18.0

zitadel 4.18.0

References

https://github.com/zitadel/zitadel/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/zitadel-3.0.0-before...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhlemmer
grvijayan
IAM-marco
AdamKorcz
.