ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the… (CVE-2026-109371)

ZITADEL 3.0.0 before 4.18.0 has a missing authentication vulnerability (CWE-306) in the hosted Login V1 UI. Specifically, the change-username handler operates on the account linked to a login flow without verifying any authentication factors. This flaw enables unauthenticated attackers to submit a victim's login name and then change the username of any active human user, including administrators, effectively locking them out of their accounts. The vulnerability has a CVSS 3.1 score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

An unauthenticated attacker can rename any active user account, including administrator accounts, without verifying authentication factors. This can lead to denial of access for legitimate users by locking them out of their accounts. The integrity of user accounts is severely impacted, while confidentiality is not affected. Availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the hosted Login V1 UI or implement additional access controls to prevent unauthenticated requests to the change-username handler.