# ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5 · pwn.watch

> ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.

Page: https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026 · generated 2026-10-29T20:46:10.933Z

## Status
- Severity: high · status: live · patch: patched
- Product: ZITADEL
- Started: 2026-10-29
- CVEs: CVE-2026-119128, CVE-2026-119127, CVE-2026-119129
- Affected: ZITADEL 4.0.0 before 4.19.5 (all three CVEs); ZITADEL 3.0.0 through 3.4.15 (CVE-2026-119129)
- Fixed in: 4.19.5

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026.json
- This file: https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-29: CVE records published for three ZITADEL Login V2 account takeover bugs, fixed in 4.19.5. (https://www.cve.org/CVERecord?id=CVE-2026-119128)

## Fix brief
# Security brief: ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5

Source: https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 16:23 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.

Severity detail: The CNA scores CVE-2026-119128 CVSS 4.0 9.1 (3.1: 7.4) and the other two CVSS 4.0 8.6 (3.1: 8.1). All three lead to account takeover, and the host header bug can reach instance administrators. No in-the-wild exploitation has been reported.

- Product: ZITADEL
- CVE / advisory ids: CVE-2026-119128, CVE-2026-119127, CVE-2026-119129

## Affected versions
- ZITADEL 4.0.0 before 4.19.5 (all three CVEs)
- ZITADEL 3.0.0 through 3.4.15 (CVE-2026-119129)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 4.19.5

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you self-host ZITADEL 4.x, upgrade to 4.19.5. Make sure your reverse proxy overwrites or strips x-forwarded-host, x-zitadel-public-host and x-zitadel-forward-host from client requests. If you're on 3.x, check the device authorization advisory for your upgrade path, and review recent password resets, new passkeys and device grants for accounts you didn't expect.

## Latest updates
- Oct 29, 2026: CVE records published for three ZITADEL Login V2 account takeover bugs, fixed in 4.19.5.

## Advisories
- [GHSA-mchc-246r-6m76: Login V2 host header injection (CVE-2026-119127)](https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76) (ZITADEL)
- [GHSA-84fg-x5h4-w8xv: Login V2 forgeable verificationCheck cookie (CVE-2026-119128)](https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xv) (ZITADEL)
- [GHSA-qj3q-235g-qr6w: device authorization approval without consent (CVE-2026-119129)](https://github.com/zitadel/zitadel/security/advisories/GHSA-qj3q-235g-qr6w) (ZITADEL)
- [CVE-2026-119128: ZITADEL Login V2 account takeover via forgeable verificationCheck cookie](https://www.cve.org/CVERecord?id=CVE-2026-119128) (CVE.org)
- [CVE-2026-119127: ZITADEL Login V2 host header injection](https://www.cve.org/CVERecord?id=CVE-2026-119127) (CVE.org)
- [CVE-2026-119129: ZITADEL device authorization approval account takeover](https://www.cve.org/CVERecord?id=CVE-2026-119129) (CVE.org)

---
Machine-readable: https://pwn.watch/i/zitadel-login-v2-account-takeover-cve-2026-119127-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.