Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Not in CISA KEV

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck CookieGHSA-84fg-x5h4-w8xv

GHSA-84fg-x5h4-w8xv is a CWE-565 vulnerability. A fix is available — see the affected versions and patch details below.

Published
Updated
Affected
66 versions
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Fix

    Upgrade the affected component to the fixed release for GHSA-84fg-x5h4-w8xv, or apply your distribution's backported patch — distro builds are often patched at an older version number, so check your vendor's advisory rather than the upstream version alone.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
O3 Security · Impact-Aware SCA

Is GHSA-84fg-x5h4-w8xv in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover…