CVE-2026-109373

{
  "etk_id": "ETK-2026-1387",
  "cve_id": "CVE-2026-109373",
  "display_id": "CVE-2026-109373",
  "ghsa_id": "GHSA-ff7c-8692-c559",
  "euvd_id": "EUVD-2026-97671",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in ZITADEL Login V2",
  "summary": "ZITADEL versions 3.0.0 through 4.19.1 are affected by an authentication bypass in the Login V2 UI. An unauthenticated attacker may obtain session tokens and take over user accounts, including administrator accounts, by abusing improperly validated session cookies. Exploitation requires the affected Login V2 UI to be exposed and a target session to be active.",
  "mitigation": "Upgrade ZITADEL to version 4.19.2 or later. Until the upgrade is complete, restrict access to the Login V2 UI to trusted networks where feasible and monitor for suspicious session activity.",
  "vendor": "zitadel",
  "product": "zitadel",
  "affected": [
    {
      "affected_notes": [
        "4.0.0 - 4.19.1"
      ],
      "affected_ranges": [],
      "ecosystem": "zitadel",
      "fixed_versions": [
        "4.19.2"
      ],
      "package_name": "ZITADEL",
      "purl": null
    },
    {
      "affected_notes": [
        "3.0.0 - 3.4.15"
      ],
      "affected_ranges": [],
      "ecosystem": "zitadel",
      "fixed_versions": [],
      "package_name": "ZITADEL",
      "purl": null
    }
  ],
  "cwes": [
    441
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0042,
  "epss_percentile": 0.3547,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.90156455,
  "t0_at": "2026-10-12T16:05:45.649000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T17:27:19.891420+00:00",
      "days": 0.05664632430555556,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T16:05:45.649000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-12T16:05:45.649000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T16:05:45.649000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109373"
    }
  }
}