Threats tagged 'ghsa-vc67-2j7f-xv7j'

ZITADEL versions from 4.0.0 up to but not including 4.19.5 contain an authentication bypass vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to set the initial credential for users who have no authentication method configured. By computing a valid verificationCheck cookie using the user ID and browser fingerprint, attackers can set passwords, register passkeys, or link identity providers, effectively taking over user accounts.