CVE-2026-119129
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability…
- Risk score
- 54/100
- CVSS
- 8.1 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the …
- Affected
- See advisory
- Fix
- Upgrade the product to 4.19.5 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
Last activity 29 Oct 2026. Patch Forecast updates every hour.