Act nowDisclosed

Advisory · CVE-2026-109373

ZITADEL Login V2 unsigned session cookies allow account takeover

The ZITADEL Login V2 UI accepts forged unsigned session cookies, so unauthenticated attackers who guess time-ordered session IDs can obtain rotated tokens and take over accounts, including MFA-completed administrator sessions. Fixed in 4.19.2.

Advisory published October 12, 2026Independent summary
Vendor
ZITADEL
Product
ZITADEL
Identifier / CWE
CVE-2026-109373
CWE-441
Action timing
Immediate
ELI5

Explain it like I’m five

Session badges are printed on plain paper with no signature, and their numbers run in time order. Anyone can copy a recent number onto a blank badge and the desk accepts it as the real visitor.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Victim signs in

    A user completes sign-in, including MFA, through the Login V2 UI and receives a session.

  2. 02Session ID guessed

    An unauthenticated attacker guesses time-ordered session IDs around the victim's sign-in time.

  3. 03Cookie forged

    The attacker supplies a guessed ID in an unsigned session cookie with an empty token.

  4. 04Tokens rotated to attacker

    The server returns rotated tokens for the victim's session, giving the attacker the account.

What happened

The ZITADEL security advisory for CVE-2026-109373 covers ZITADEL 3.0.0 before 4.19.2 and rates the flaw CVSS 4.0 9.2, CVSS 3.1 8.1.

The Login V2 UI accepts session cookies that are not signed. Unauthenticated attackers can guess time-ordered session IDs around a victim’s sign-in, supply one with an empty token, and receive rotated tokens for that session. That takes over the account, including sessions where an administrator has already completed MFA, because the stolen session sits after the MFA step.

Per the advisory record, 4.19.2 is the fixed release.

What to do

  1. Inventory ZITADEL instances and check each version, including whether Login V2 is in use.
  2. Upgrade affected instances to ZITADEL 4.19.2 or later.
  3. Invalidate existing Login V2 sessions on upgraded instances so previously issued sessions cannot be replayed.
  4. Review session and token logs for rotations requested with empty or malformed tokens, or from unfamiliar locations.
  5. Pay particular attention to administrator sessions created or rotated around the upgrade window.
  6. Confirm the deployed version after upgrading.

Management note

MFA does not mitigate this flaw, because what is stolen is the finished, post-MFA session. For an identity provider, that makes this a patch-today item and a session invalidation exercise, not a user education problem.