CVE ID :CVE-2026-109371 Published : Oct. 12, 2026, 5:17 p.m. | 14 minutes ago Description :ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-109371 - ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

VERWANDTEARTIKEL

CVE-2026-85965 - Use-after-free in Progress MarkLogic Server JavaScript engine integration

CVE-2026-109373 - ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

CVE-2026-109372 - ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

CVE-2026-109357 - LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

CVE-2026-109358 - Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

CVE-2026-109359 - Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery