# CVE-2026-109371: ZITADEL hosted Login V1 authentication bypass in username change

Source: https://junglewise.ai/threats/cve-2026-109371-zitadel-3-0-0-before-4-18-0-contains-a-missing-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109371 · Severity: high · CVSS 8.2 · Published 2026-10-12

ZITADEL is an identity management platform that provides hosted authentication services for applications. The Login V1 UI has a flaw that allows an unauthenticated attacker to rename any user account, including administrators, by simply knowing their login name—without providing a password or satisfying any security factors. This can lock legitimate users out of their accounts and enable attackers to squat on released usernames.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-109371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109371 being exploited in the wild.

**How severe is CVE-2026-109371?** High severity, with a CVSS score of 8.2, published 12 October 2026.

**Which products and versions are affected?** ZITADEL 3.0.0 through 3.4.15; 4.0.0 through 4.17.3.

**Is there a fix for CVE-2026-109371?** Yes: fixed in ZITADEL v4.19.1 (3.x line reached end-of-life 2026-08-31 and will not receive a patch). Until then: No configuration fully closes this vulnerability on unpatched versions. Upgrade to a patched release, noting that v4.18.0 should be skipped and v4.19.1 used instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109371 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109371?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZITADEL v4.19.1 (3.x line reached end-of-life 2026-08-31 and will not receive a patch)

No configuration fully closes this vulnerability on unpatched versions. Upgrade to a patched release, noting that v4.18.0 should be skipped and v4.19.1 used instead.

## Technical details

The change-username handler in the hosted Login V1 UI acts on an account selected by login name before the login flow has reached the change-username step or verified any authentication factor. An unauthenticated attacker can initiate a login flow, submit a victim's login name to bind the account, and then POST a new username directly, bypassing factor verification. The vulnerability affects only active human users across all organizations on an instance; machine and service accounts are not affected.

## Affected products

- ZITADEL ZITADEL 3.0.0 through 3.4.15; 4.0.0 through 4.17.3

## Timeline

- 2026-09-24: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-4hgj-wm6c-q7p2](https://github.com/zitadel/zitadel/security/advisories/GHSA-4hgj-wm6c-q7p2)
- [https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.18.0-unauthenticated-username-change-via-login-v1](https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.18.0-unauthenticated-username-change-via-login-v1)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)