HIGH 8.8 NVD
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bou
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-4hgj-wm6c-q7p2
- https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.18.0-unauthenticated-username-
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.