ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.19.5
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
ZITADEL, an open-source identity and access management platform, is affected through its Login V2 user interface. An unauthenticated attacker could take over user accounts that have no authentication method set up by forging a verification cookie, then setting their own password, passkey, or linked identity provider.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- zitadel zitadel
From 4.0.0 · fixed in 4.19.5