{"metadata": {"vulnerability": "CVE-2026-109373", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109373", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:23:25.691Z", "date_only": false, "value": "2026-10-12T14:23:25.691Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109373", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:45.649Z", "date_only": false, "value": "2026-10-12T16:05:45.649Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109373", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:45.649Z", "date_only": false, "value": "2026-10-12T16:05:45.649Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109373", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:17:35Z", "date_only": false, "value": "2026-10-12T17:17:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FF7C-8692-C559", "record": "GHSA-FF7C-8692-C559", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:35.110Z", "date_only": false, "value": "2026-10-12T17:17:35.110", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109373", "record": "FKIE_CVE-2026-109373", "field": "published"}, {"timestamp": "2026-10-12T17:55:37.630Z", "date_only": false, "value": "2026-10-12T17:55:37.630906Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429222582610825", "record": "CVE-2026-109373", "field": "creation_timestamp", "uuid": "4cbb6952-e199-43bc-9a89-34448795c43d", "content": "CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109373https://github.com/zitadel/zitadel/security/advisories/GHSA-jh92-5mrj-p2w2https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-unsigned-login-v2-session-cookie#zitadel#CVE_2026_109373#bot", "url": "https://infosec.exchange/users/cve/statuses/117429222582610825"}, {"timestamp": "2026-10-12T18:09:27.747Z", "date_only": false, "value": "2026-10-12T18:09:27.747819Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxp4gnsliz2o", "record": "CVE-2026-109373", "field": "creation_timestamp", "uuid": "2b5b08f6-b8c2-414b-9d35-03ca0c98b5db", "content": "\ud83d\udea8 CVE-2026-109373 \u2014 CVSS 9.2 CRITICAL\n\nZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-109373\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxp4gnsliz2o"}, {"timestamp": "2026-10-12T18:31:54Z", "date_only": false, "value": "2026-10-12T18:31:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FF7C-8692-C559", "record": "GHSA-FF7C-8692-C559", "field": "published"}, {"timestamp": "2026-10-12T18:31:54Z", "date_only": false, "value": "2026-10-12T18:31:54Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FF7C-8692-C559", "record": "GHSA-FF7C-8692-C559", "field": "modified"}, {"timestamp": "2026-10-12T19:50:04.643Z", "date_only": false, "value": "2026-10-12T19:50:04.643117Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpc2l42gi2r", "record": "CVE-2026-109373", "field": "creation_timestamp", "uuid": "53a383d0-2bc2-4139-8a0b-a13100e64f46", "content": "CVE-2026-109373\nVersions of ZITADEL from 3.0.0 up to, but not including, 4.19.2 let anyone who can reach the login page guess a session code and obtain a valid session token for another user. This can give full control of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpc2l42gi2r"}, {"timestamp": "2026-10-13T16:40:46.999Z", "date_only": false, "value": "2026-10-13T16:40:46.999946Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109373", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T16:40:46.999Z", "date_only": false, "value": "2026-10-13T16:40:46.999946Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109373", "record": "FKIE_CVE-2026-109373", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T16:53:01.016Z", "date_only": false, "value": "2026-10-13T16:53:01.016Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109373", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:53:01.016Z", "date_only": false, "value": "2026-10-13T16:53:01.016Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109373", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T17:17:27.770Z", "date_only": false, "value": "2026-10-13T17:17:27.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109373", "record": "FKIE_CVE-2026-109373", "field": "lastModified"}, {"timestamp": "2026-10-16T07:49:33.257Z", "date_only": false, "value": "2026-10-16T07:49:33.257963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yogsec.bsky.social/post/3mxy3nstcn22d", "record": "CVE-2026-109373", "field": "creation_timestamp", "uuid": "1557f3b4-0b94-4ab4-bd3f-5998772305a5", "content": "CVE-2026-109373\n\nZITADEL Login V2 auth bypass. Unauthenticated attackers can forge unsigned session cookies with guessable time-ordered session IDs, enabling full account takeover including MFA-completed sessions.\n\nnvd.nist.gov/vuln/detail/...\n\n#CVE #ZITADEL #AuthenticationBypass #IdentitySecurity", "url": "https://bsky.app/profile/yogsec.bsky.social/post/3mxy3nstcn22d"}]}