CVE-2026-119128

The record

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

Affected packages

Related vulnerabilities

• CVE-2026-118661 Happy DOM is a JavaScript implementation of a web browser without its graphical user… CWE-565
• CVE-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that… CWE-565
• CVE-2026-111749 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-565
• CVE-2026-75757 Reliance on Cookies without Validation and Integrity Checking vulnerability in… CWE-565
• CVE-2026-53871 Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the… CWE-565
• CVE-2026-8337 Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site… CWE-565
• CVE-2026-0257 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo… CWE-565
• CVE-2026-39963 Serendipity is a PHP-powered weblog engine. CWE-565