CVE-2026-119129

High

Description

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.

SeverityHigh

CVSS8.1

Exploit probability—

ProductZitadel

PublishedOct 29, 2026

First seenNov 4, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

zitadel zitadel4.19.5 or later

Vendor advisories

github.com/zitadel/zitadel/security/advisories/GHSA-qj3q-235g-qr6w

Affected products

Product	Affected versions	Fixed in
zitadel zitadel	4.0.0 ≤ v < 4.19.5, 3.0.0 ≤ v ≤ 3.4.15	4.19.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.