{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5 · updates",
  "home_page_url": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026",
  "feed_url": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/feed.json",
  "description": "ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.",
  "language": "en",
  "_pwn": {
    "slug": "zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026#2026-10-29-d1f6e233",
      "url": "https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026#2026-10-29-d1f6e233",
      "title": "ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5: CVE records published for three ZITADEL Login V2 account takeover bugs, fixed in 4.19.5.",
      "content_text": "ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5: CVE records published for three ZITADEL Login V2 account takeover bugs, fixed in 4.19.5.\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-119128",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-119128",
      "tags": [
        "high"
      ]
    }
  ]
}