The vulnerability is a missing authentication check in the hosted Login V1 user interface of ZITADEL. The change‑username handler processes requests before any authentication or verification factor is applied. An attacker can send a request with a victim’s login name and then supply a new username, causing the system to rename any active human account, including administrators. This allows an attacker to lock out legitimate users and potentially disrupt services, violating account integrity and availability.

The flaw exists in the ZITADEL product (zitadel) for all installations configured to use the Login V1 UI. Affected releases are ZITADEL 3.0.0 up to, but not including, 4.18.0. Users running any of these versions are vulnerable unless the Login V1 flow is disabled.

The CVSS score is 8.8, indicating high severity. EPSS is not available, and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is unauthenticated web access to the Login V1 endpoint; no special credentials are required. A threat actor could exploit this remotely by crafting HTTP requests against the exposed UI, achieving account takeover or denial of service for targeted users.