{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zitadel-4.x--4.19.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-109371"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ZITADEL (\u003c 4.18.0)","ZITADEL (4.x \u003c 4.19.2)","ZITADEL (3.x \u003c= 3.4.15)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ZITADEL"],"content_html":"\u003cp\u003eZITADEL versions 3.0.0 through 4.17.x are affected by a missing authentication vulnerability located within the hosted Login V1 UI component. The flaw exists in the change-username handler, which processes requests to modify account identifiers without first verifying any authentication factors. By interacting with an active login flow, an unauthenticated attacker can submit a target user's login name followed by a request to update that identifier. This action effectively renames the account, causing a denial of service by locking legitimate users, including administrators, out of their accounts. This vulnerability is significant due to the impact on identity and access management security, potentially allowing an attacker to neutralize administrative control over the ZITADEL instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized modification of user identities and account lockout. Organizations using affected ZITADEL deployments face the risk of total loss of administrative access if those accounts are targeted. The vulnerability impacts all ZITADEL instances running versions between 3.0.0 and 4.17.x.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all ZITADEL deployments to version 4.18.0 or later immediately to patch CVE-2026-109371.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized attempts to invoke the Login V1 UI change-username handler.\u003c/li\u003e\n\u003cli\u003eEnsure administrative accounts are managed through secure, hardened identity providers where possible to mitigate the impact of identity-based attacks against the ZITADEL platform.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:38:36Z","date_published":"2026-10-12T18:38:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zitadel-missing-auth/","summary":"An unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.","title":"Missing Authentication Vulnerability in ZITADEL Login V1 UI","url":"https://feed.craftedsignal.io/briefs/2026-10-zitadel-missing-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - ZITADEL (4.x \u003c 4.19.2)","version":"https://jsonfeed.org/version/1.1"}