Advisory · CVE-2026-109371
ZITADEL Login V1 allows unauthenticated username changes
The hosted ZITADEL Login V1 change-username handler acts on the account bound to a login flow before any factor is verified, so an unauthenticated attacker can rename any active human user, including administrators, and lock them out. Fixed in 4.18.0.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-109371
CWE-306 - Action timing
- Immediate
Explain it like I’m five
The nameplate on an office door can be changed by anyone who walks up and asks, before showing any ID. Ask for the boss's door and the boss is renamed and locked out.
- 01Login flow started
An unauthenticated attacker starts a hosted Login V1 flow and submits a victim's login name.
- 02Account bound
The flow binds the victim's account before any authentication factor is verified.
- 03Username posted
The attacker posts a new username to the change-username handler for that bound account.
- 04Victim renamed
The account is renamed without authentication, locking the real user, including administrators, out.
What happened
The ZITADEL security advisory for CVE-2026-109371 covers ZITADEL 3.0.0 before 4.18.0 and rates the flaw CVSS 3.1 8.2.
The hosted Login V1 UI has a missing authentication flaw in its change-username handler. The handler acts on the account bound to a login flow before any factor is verified. An unauthenticated attacker can submit a victim’s login name, then post a new username and rename any active human user, including administrators, locking them out of their accounts.
Per the advisory record, 4.18.0 is the fixed release.
What to do
- Inventory ZITADEL instances and check each version, including whether the hosted Login V1 UI is enabled.
- Upgrade affected instances to ZITADEL 4.18.0 or later.
- Review user change events for username changes that account owners did not request.
- Restore renamed accounts and confirm administrator accounts are intact and reachable.
- Restrict access to the hosted login UI where practical until upgraded.
- Confirm the deployed version after upgrading.
Management note
Renaming administrators is an availability and incident-response problem at the worst possible layer: the identity provider itself. Check your admin accounts still exist under their expected names before assuming a lockout is a user error.