VulnSocial

CVE-2026-109373

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-441

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 1 mentions (2026-10-15); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-10-15: 1Mentions · 2026-10-16: 110-1510-16
Referenced assets2 URLs
Full discourse2 posts
  • Abhinav Singwal@yogsec

    CVE-2026-109373 ZITADEL Login V2 authentication bypass. Unauthenticated attackers can forge unsigned session cookies with guessable time-ordered session IDs, enabling full account takeover including MFA-completed administrator sessions. Versions 3.0.0 through 4.19.1 affected. Upgrade to 4.19.2 or later. CVSS 9.2 Critical. CWE-287 Improper Authentication. https://nvd.nist.gov/vuln/detail/CVE-2026-109373 #CVE #ZITADEL #AuthenticationBypass #IdentitySecurity

    0000027
    523 followersView on X
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs

    CVE-2026-109373 affects ZITADEL. Forged session cookies can allow unauthenticated attackers to hijack user sessions and bypass MFA, including for administrator accounts. Analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-10-12/TIER_2_CVE-2026-109373.md #CyberSecurity #DigitalIdentity #MFA

    0000029
    64 followersView on X

Explore more

Back to dashboard