BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Zitadel

CVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential

CVE-2026-119128 Oct 29, 2026 Source: Vendor

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-119128
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines
All 2 CVEs 2 Additional recognition 0 Unclaimed only
Showing 1–2 of 2 matching , clear filters
CVE-2026-119128 BR2026-0000-038229 unclaimed
Credited as AdamKorcz
CVE-2026-119128 BR2026-0000-038230 unclaimed
Credited as knQzx