Authentication Bypass in ZITADEL 3.0.0 Affecting User Session Tokens

CVE-2026-109373

What is CVE-2026-109373?

ZITADEL versions prior to 4.19.2 are susceptible to an authentication bypass vulnerability within the Login V2 UI. This flaw enables unauthorized users to exploit unsigned session cookies, allowing them to forge session tokens of legitimate users. Attackers can sequentially guess time-ordered session IDs linked to a victim's sign-in attempt, submitting empty tokens to receive valid rotated tokens. This can lead to unauthorized access to user accounts, including those with multi-factor authentication (MFA) protection, potentially compromising sensitive administrative functions.

References