ZITADEL versions 3.0.0 through 4.19.1 contain an authentication bypass in the Login V2 user interface that lets an unauthenticated attacker forge an unsigned session cookie and guesses a time‑ordered session identifier. By supplying an empty token, the server issues a rotated token that carries the victim’s privileges, enabling the attacker to immediately take control of any account, including MFA‑protected administrators.

The flaw affects ZITADEL deployments that run any version from 3.0.0 up through 4.19.1. Deployments using the Zitadel product (CPE: cpe:2.3:a:zitadel:zitadel) are impacted if they have not upgraded past version 4.19.1 or applied the vendor’s fix.

The CVSS score of 9.2 identifies this as a critical flaw. EPSS information is not available, but the lack of required authentication and the ease of guessing a session token make exploitation highly plausible, especially against systems with active users. The vulnerability is not currently listed in CISA’s KEV catalog, but its high severity and the ability to compromise privileged accounts warrant immediate attention. Attackers can gain full control of accounts by submitting a crafted, unsigned cookie, so the attack vector is client‑side input manipulation.