{"metadata": {"vulnerability": "CVE-2026-119128", "count": 18, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119128", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T14:26:15.521Z", "date_only": false, "value": "2026-10-29T14:26:15.521Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119128", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T15:58:10.483Z", "date_only": false, "value": "2026-10-29T15:58:10.483Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119128", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T15:58:10.483Z", "date_only": false, "value": "2026-10-29T15:58:10.483Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119128", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T16:18:05Z", "date_only": false, "value": "2026-10-29T16:18:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VC67-2J7F-XV7J", "record": "GHSA-VC67-2J7F-XV7J", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-29T16:18:05.643Z", "date_only": false, "value": "2026-10-29T16:18:05.643", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119128", "record": "FKIE_CVE-2026-119128", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T16:29:57.446Z", "date_only": false, "value": "2026-10-29T16:29:57.446511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/56lxfbiomuphc", "record": "CVE-2026-119128", "field": "creation_timestamp", "uuid": "2987c92e-e907-4568-99af-bb56bde7984e", "content": "CVE-2026-119128\nNew critical vulnerability: CVSS 9.1.\nhttps://cvesentinel.com/report/CVE-2026-119128", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/56lxfbiomuphc"}, {"timestamp": "2026-10-29T17:02:01.595Z", "date_only": false, "value": "2026-10-29T17:02:01.595262Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bw7an3i4fgxte", "record": "CVE-2026-119128", "field": "creation_timestamp", "uuid": "c68a406e-c7a3-42e2-8a8c-74384b41d10b", "content": "CVE-2026-119128 - ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie\nCVE ID : CVE-2026-119128\n \n Published : Oct. 29, 2026, 3:58 p.m. | 27\u00a0minutes ago\n \n Description : ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulne...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/bw7an3i4fgxte"}, {"timestamp": "2026-10-29T17:10:15.401Z", "date_only": false, "value": "2026-10-29T17:10:15.401403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myzr24tefo2b", "record": "CVE-2026-119128", "field": "creation_timestamp", "uuid": "9f520274-dc1d-4134-b9fd-44f74e6ca77e", "content": "CVE-2026-119128 - zitadel\nVersions of ZITADEL before 4.19.5 let an unauthenticated person trick the login page and set a password or add a login method for any user who does not already have one. The attacker can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zitadel #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myzr24tefo2b"}, {"timestamp": "2026-10-29T17:30:35.180Z", "date_only": false, "value": "2026-10-29T17:30:35.180334Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117525383064436107", "record": "CVE-2026-119128", "field": "creation_timestamp", "uuid": "1dc48ff0-70bf-429e-af17-019afa78cd9b", "content": "CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119128https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xvhttps://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-login-v2-account-takeover-via-forgeable-verificationcheck-cookie#zitadel#CVE_2026_119128#bot", "url": "https://infosec.exchange/users/cve/statuses/117525383064436107"}, {"timestamp": "2026-10-29T18:08:30.932Z", "date_only": false, "value": "2026-10-29T18:08:30.932927Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myzucmfavb22", "record": "CVE-2026-119128", "field": "creation_timestamp", "uuid": "56104272-6649-47eb-8fb7-4755d57e4232", "content": "\ud83d\udea8 CVE-2026-119128 \u2014 CVSS 9.1 CRITICAL\n\nZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119128\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myzucmfavb22"}, {"timestamp": "2026-10-29T18:30:59Z", "date_only": false, "value": "2026-10-29T18:30:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VC67-2J7F-XV7J", "record": "GHSA-VC67-2J7F-XV7J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T18:30:59Z", "date_only": false, "value": "2026-10-29T18:30:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VC67-2J7F-XV7J", "record": "GHSA-VC67-2J7F-XV7J", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T15:43:14.257Z", "date_only": false, "value": "2026-11-03T15:43:14.257977Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119128", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-03T15:43:14.257Z", "date_only": false, "value": "2026-11-03T15:43:14.257977Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119128", "record": "FKIE_CVE-2026-119128", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-03T15:45:54.764Z", "date_only": false, "value": "2026-11-03T15:45:54.764Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119128", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T15:45:54.764Z", "date_only": false, "value": "2026-11-03T15:45:54.764Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119128", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T16:17:21.107Z", "date_only": false, "value": "2026-11-03T16:17:21.107", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119128", "record": "FKIE_CVE-2026-119128", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T10:57:01.739Z", "anchors": {"origin": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119128", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119128", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2545021.739619, "hours": 706.9504832275, "days": 29.456270134479166, "min_seconds": 2458621.739619, "max_seconds": 2545021.739619, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119128", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T10:57:01.739Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}