CVE-2026-109373: ZITADEL Login V2 UI Auth Bypass Vulnerability

CVE-2026-109373 Overview

CVE-2026-109373 is a critical authentication bypass vulnerability in ZITADEL versions 3.0.0 through 4.19.1. The flaw resides in the Login V2 UI, which accepts unsigned session cookies without proper cryptographic validation. Unauthenticated attackers can forge session cookies containing guessed, time-ordered session identifiers and receive rotated tokens in response. This technique allows takeover of arbitrary accounts, including administrator sessions that have already completed multi-factor authentication (MFA). The vulnerability is classified under [CWE-441] (Unintended Proxy or Intermediary) and affects deployments using the Login V2 experience.

Critical Impact

Remote, unauthenticated attackers can hijack any active user session, including MFA-completed administrator accounts, by guessing time-ordered session IDs and submitting unsigned cookies with empty tokens.

Affected Products

• ZITADEL 3.0.0 through 4.19.1
• ZITADEL Login V2 UI component
• Self-hosted and cloud ZITADEL deployments using the vulnerable Login V2 flow

Discovery Timeline

• 2026-10-12 - CVE-2026-109373 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109373

Vulnerability Analysis

ZITADEL is an open-source identity and access management platform providing authentication, authorization, and user management services. The Login V2 UI issues session cookies to track user authentication state throughout the sign-in flow. The affected versions fail to cryptographically sign or verify these cookies before trusting their contents.

An attacker can craft a cookie carrying a candidate session ID with an empty token value. The server treats the cookie as valid, locates the matching session, and returns a rotated token tied to that session. Because session IDs are allocated in time order, an attacker who observes or estimates when a victim signed in can enumerate a narrow range of IDs and locate active sessions. Successful enumeration yields full account takeover without credentials, password reset, or MFA interaction.

Root Cause

The root cause is the absence of a signature or integrity check on session cookies issued by Login V2. Combined with sequentially predictable session identifiers and acceptance of empty token values during rotation, the server trusts attacker-controlled cookie data to retrieve a valid session token. The design assumes cookie contents originate from a prior legitimate response, but no cryptographic binding enforces that assumption.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker:

1. Observes or infers the approximate timestamp of a victim's sign-in event.
2. Generates a set of candidate session IDs within the expected time window.
3. Submits forged cookies with those IDs and empty token fields to the Login V2 endpoint.
4. Receives a rotated session token for any matching session and uses it to impersonate the victim.

MFA state carried in the hijacked session is preserved, so administrator accounts protected by second factors remain exposed. Refer to the GitHub Security Advisory GHSA-jh92-5mrj-p2w2 and the VulnCheck Advisory on ZITADEL for additional technical detail.

Detection Methods for CVE-2026-109373

Indicators of Compromise

• Repeated requests to Login V2 endpoints carrying session cookies with empty or missing token fields.
• High volumes of session lookups referencing session IDs across a narrow time range from a single source address.
• Unexpected token rotation events for sessions that did not originate from the associated user's client fingerprint or geolocation.
• Administrator session activity from new IP addresses immediately following suspicious enumeration patterns.

Detection Strategies

• Instrument the Login V2 session endpoint to log every token rotation request alongside the source IP, user agent, and cookie contents.
• Alert when the same client submits multiple session IDs within seconds, which indicates enumeration of time-ordered identifiers.
• Correlate successful session takeovers with prior failed lookups for adjacent session IDs from the same source.

Monitoring Recommendations

• Forward ZITADEL application and audit logs to a centralized analytics platform for retention and correlation.
• Baseline normal session rotation frequency per user, and flag deviations that exceed expected authentication cadence.
• Monitor for administrator role usage from IP addresses or devices that have not previously appeared in audit history.

How to Mitigate CVE-2026-109373

Immediate Actions Required

• Upgrade ZITADEL to version 4.19.2 or later across all production and non-production environments.
• Invalidate all active sessions after upgrade to evict any attacker who may already hold hijacked tokens.
• Rotate administrator credentials and audit privileged account activity for unauthorized changes.
• Review audit logs for the indicators listed above dating back to the first vulnerable deployment.

Patch Information

ZITADEL released a fix in version 4.19.2. Operators running any release between 3.0.0 and 4.19.1 must upgrade. See the GitHub Security Advisory GHSA-jh92-5mrj-p2w2 for the authoritative patch notes and version matrix.

Workarounds

• No vendor-supplied workaround avoids the upgrade. Patching is the only complete remediation.
• Where immediate patching is not feasible, restrict network access to the Login V2 UI using IP allow-listing or a reverse proxy with rate limiting.
• Enforce short session lifetimes and aggressive idle timeouts to reduce the window during which guessable session IDs are valid.

# Example: upgrade a self-hosted ZITADEL container deployment
docker pull ghcr.io/zitadel/zitadel:v4.19.2
docker stop zitadel && docker rm zitadel
docker run -d --name zitadel \
  -p 8080:8080 \
  -e ZITADEL_EXTERNALSECURE=true \
  ghcr.io/zitadel/zitadel:v4.19.2 start-from-init