Is CVE-2026-109373 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109373 being exploited in the wild.

How severe is CVE-2026-109373?

High severity, with a CVSS score of 8.1, published 12 October 2026.

Which products and versions are affected?

ZITADEL 3.0.0 to 3.4.15, 4.0.0 to 4.19.1.

How is CVE-2026-109373 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-109373?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109373: ZITADEL authentication bypass in Login V2 UI

CVE-2026-109373 · Severity: high · CVSS 8.1 · Published 2026-10-12

ZITADEL is an identity and access management platform that handles user authentication and authorization for enterprise applications. An unauthenticated attacker can forge session cookies to guess legitimate users' session IDs and take over their accounts—including administrator accounts with MFA enabled—without requiring passwords, stolen tokens, or any victim interaction. This enables full account takeover and unauthorized access to any application or service relying on ZITADEL for authentication.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-109373 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109373 being exploited in the wild.
How severe is CVE-2026-109373?: High severity, with a CVSS score of 8.1, published 12 October 2026.
Which products and versions are affected?: ZITADEL 3.0.0 to 3.4.15, 4.0.0 to 4.19.1.
Is there a fix for CVE-2026-109373?: Yes: fixed in 4.19.2 (3.x reached end-of-life and will not receive a fix; must upgrade to patched 4.x release). Until then: Rate limiting requests to the Login V2 UI at a reverse proxy reduces the feasibility of the session ID search but does not fully close the gap; upgrading to a patched version is the recommended solution. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109373 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-109373?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.19.2 (3.x reached end-of-life and will not receive a fix; must upgrade to patched 4.x release)

Rate limiting requests to the Login V2 UI at a reverse proxy reduces the feasibility of the session ID search but does not fully close the gap; upgrading to a patched version is the recommended solution.

Technical details

The Login V2 UI stores session references in unsigned browser cookies and uses service-user credentials with session.write permission to update sessions via the session API, which accepts token-less updates. An attacker can forge a cookie with a guessed time-ordered session ID and empty token to trigger session rotation, receiving a valid token for any session they can predict. The attack requires network access to the Login V2 UI and timing precision to narrow the session ID search window based on victim sign-in estimates.

Affected products

ZITADEL ZITADEL 3.0.0 to 3.4.15, 4.0.0 to 4.19.1

Timeline

2026-09-28: disclosed: GitHub Security Advisory GHSA-jh92-5mrj-p2w2 published
2026-10-12: advisory: CVE-2026-109373 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.