CVE-2026-109371: ZITADEL Authentication Bypass Vulnerability

CVE-2026-109371 Overview

CVE-2026-109371 is a missing authentication vulnerability [CWE-306] in ZITADEL, an open-source identity and access management platform. The flaw resides in the hosted Login V1 UI, where the change-username handler operates on the account bound to a login flow before any authentication factor is verified. An unauthenticated attacker can submit a victim's login name and then post a new username, renaming any active human user. The attack affects administrator accounts, enabling account lockout and denial of access to the identity platform. Versions 3.0.0 through 4.17.x are affected, with a fix available in 4.18.0.

Critical Impact

Unauthenticated attackers can rename any human user, including administrators, locking legitimate users out of the identity platform.

Affected Products

• ZITADEL 3.0.0 through 4.17.x (hosted Login V1 UI)
• ZITADEL deployments exposing the Login V1 interface to untrusted networks
• Any application relying on ZITADEL for identity management on affected versions

Discovery Timeline

• 2026-10-12 - CVE-2026-109371 published to the National Vulnerability Database (NVD)
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109371

Vulnerability Analysis

The vulnerability affects the hosted Login V1 UI shipped with ZITADEL releases prior to 4.18.0. During a standard login flow, the server creates an authentication session bound to the submitted login name. The change-username handler is reachable from that session but does not verify that any authentication factor, such as a password, one-time code, or passkey, has been completed. An attacker who knows or guesses a victim's login name can therefore initiate a flow and immediately submit a new username value, which the server accepts and persists.

The impact is targeted integrity loss on user records. By renaming the login identifier, the attacker breaks the victim's ability to authenticate using their known credentials. Administrator accounts are not excluded from the operation, which allows an attacker to disrupt tenant management and incident response.

Root Cause

The root cause is a missing authentication check on a state-changing operation in the Login V1 flow. The handler assumes that any request within an active login session is authorized to mutate the bound account, violating the principle that account modifications require proof of possession or control. This maps directly to CWE-306: Missing Authentication for Critical Function.

Attack Vector

The attack is network-reachable, requires no privileges, and requires no user interaction. An attacker initiates a login flow against the Login V1 endpoint using the target's known or enumerated login name. The attacker then issues the username-change request within that flow context, supplying an arbitrary new username. The server rewrites the user record without validating any authentication factor.

No verified public exploit code is available at the time of writing. See the GitHub Security Advisory GHSA-4hgj-wm6c-q7p2 and the VulnCheck Advisory for ZITADEL for upstream technical details.

Detection Methods for CVE-2026-109371

Indicators of Compromise

• Unexpected change-username requests against the Login V1 endpoint from unauthenticated sessions or unfamiliar source addresses.
• Audit log entries showing username changes on administrator or privileged accounts without a preceding successful authentication event.
• User reports of sudden login failures using previously valid usernames, correlated with recent username-change events in ZITADEL audit logs.

Detection Strategies

• Review ZITADEL event streams for user.username.changed events and correlate each with a prior successful factor verification in the same session.
• Alert on any username-change event where the initiating session has no completed password, OTP, or passkey step.
• Monitor web access logs for POST requests to Login V1 username-change paths originating from IP addresses that have not completed authentication.

Monitoring Recommendations

• Forward ZITADEL audit logs to a centralized logging platform for retention and correlation across sessions and source IPs.
• Baseline the normal rate of legitimate username changes per tenant and alert on deviations, especially bursts affecting multiple accounts.
• Track administrator-account mutations as high-priority events and route them to on-call identity operations staff.

How to Mitigate CVE-2026-109371

Immediate Actions Required

• Upgrade ZITADEL to version 4.18.0 or later, which contains the fix for the missing authentication check in the Login V1 username-change handler.
• Audit all ZITADEL users, prioritizing administrator and service-owner accounts, to confirm that current login names match expected values.
• Restrict network exposure of the Login V1 UI where feasible, limiting access to trusted networks until the upgrade is completed.

Patch Information

The vulnerability is fixed in ZITADEL 4.18.0. Operators running any release in the 3.0.0 through 4.17.x range should upgrade using the vendor's standard release channel. Refer to the GitHub Security Advisory GHSA-4hgj-wm6c-q7p2 for the authoritative patch notes and upgrade guidance.

Workarounds

• Migrate authentication flows to the Login V2 UI if operationally feasible, as the vulnerability is specific to the Login V1 handler.
• Place a web application firewall or reverse proxy in front of ZITADEL and block unauthenticated requests to the Login V1 username-change path until the patch is deployed.
• Monitor and alert on all username-change events in near real time so that unauthorized changes can be reverted promptly from audit history.

# Example: block the Login V1 change-username path at an NGINX reverse proxy
# until ZITADEL is upgraded to 4.18.0 or later.
location ~* /ui/login/.*/change-username {
    return 403;
}