ZITADEL CVE-2026-109373

Exploitation requires the target to be running ZITADEL's Login V2 UI (versions 3.0.0 up to but not including 4.19.2); the flaw is in that specific login experience, so instances not using Login V2 are outside the described attack surface. The attacker needs no credentials and no user interaction (PR:N/UI:N), but per AT:P must successfully exploit a timing condition: forging an unsigned session cookie and guessing a session ID from the narrow, time-ordered range generated around a victim's sign-in event, then submitting an empty token to force token rotation. The principal limiting factors are therefore (1) the need to coincide with or closely predict a victim's active authentication window, and (2) the requirement that the deployment runs an affected Login V2 version; successful cookie forgery is possible because session cookies are not properly signed/validated.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with no user interaction, and the impact is total: VC:H/VI:H/VA:H reflecting full account takeover, explicitly including MFA-completed administrator sessions - a complete authentication-bypass and privilege outcome for an identity provider, which is among the worst possible targets since it governs access to everything downstream. The one mitigating signal is AT:P (Attack Requirement: Present), which corresponds to the described need to win a timing race by guessing time-ordered session IDs created around a victim's sign-in; exploitation is therefore opportunistic and conditioned on catching a victim mid-authentication rather than trivially replayable at will. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating rests on the vendor/GHSA advisory and VulnCheck reporting plus the severity of the impact, not on observed in-the-wild activity. Signals are consistent (no conflict between vector and description), but the absence of EPSS/KEV means widespread automated exploitation cannot be confirmed - treat this as credible and urgent to patch given the admin-takeover potential, while recognizing the timing requirement limits mass, unauthenticated scanning-style abuse.

An unauthenticated attacker monitors or anticipates a victim signing in to a ZITADEL Login V2 instance, then forges unsigned session cookies and guesses the time-ordered session IDs generated around that sign-in, supplying them with empty tokens to receive freshly rotated valid tokens. By winning this timing window the attacker takes over the victim's authenticated session, including sessions that have already completed MFA, yielding account or administrator takeover. No public exploit code was identified at time of analysis, and the AT:P attack requirement means success depends on correctly timing the victim's authentication.