ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5

ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.

Why this severity: The CNA scores CVE-2026-119128 CVSS 4.0 9.1 (3.1: 7.4) and the other two CVSS 4.0 8.6 (3.1: 8.1). All three lead to account takeover, and the host header bug can reach instance administrators. No in-the-wild exploitation has been reported.

Started

Oct 29, 2026

CVEs

CVE-2026-119128CVE-2026-119127CVE-2026-119129

• #ZITADEL
• #Identity
• #Account Takeover
• Auth bypass
• #OAuth