Is CVE-2026-109371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109371 being exploited in the wild.

How severe is CVE-2026-109371?

High severity, with a CVSS score of 8.2, published 12 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 through 3.4.15; 4.0.0 through 4.17.3.

How is CVE-2026-109371 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109371?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109371: ZITADEL hosted Login V1 authentication bypass in username change

CVE-2026-109371 · Severity: high · CVSS 8.2 · Published 2026-10-12

ZITADEL is an identity management platform that provides hosted authentication services for applications. The Login V1 UI has a flaw that allows an unauthenticated attacker to rename any user account, including administrators, by simply knowing their login name—without providing a password or satisfying any security factors. This can lock legitimate users out of their accounts and enable attackers to squat on released usernames.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-109371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109371 being exploited in the wild.
How severe is CVE-2026-109371?: High severity, with a CVSS score of 8.2, published 12 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 through 3.4.15; 4.0.0 through 4.17.3.
Is there a fix for CVE-2026-109371?: Yes: fixed in ZITADEL v4.19.1 (3.x line reached end-of-life 2026-08-31 and will not receive a patch). Until then: No configuration fully closes this vulnerability on unpatched versions. Upgrade to a patched release, noting that v4.18.0 should be skipped and v4.19.1 used instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109371 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109371?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ZITADEL v4.19.1 (3.x line reached end-of-life 2026-08-31 and will not receive a patch)

No configuration fully closes this vulnerability on unpatched versions. Upgrade to a patched release, noting that v4.18.0 should be skipped and v4.19.1 used instead.

Technical details

The change-username handler in the hosted Login V1 UI acts on an account selected by login name before the login flow has reached the change-username step or verified any authentication factor. An unauthenticated attacker can initiate a login flow, submit a victim's login name to bind the account, and then POST a new username directly, bypassing factor verification. The vulnerability affects only active human users across all organizations on an instance; machine and service accounts are not affected.

Affected products

ZITADEL ZITADEL 3.0.0 through 3.4.15; 4.0.0 through 4.17.3

Timeline

2026-09-24: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.