{"id":"CVE-2024-29892","aliases":["EUVD-2024-0928","GHSA-gp8g-f42f-95q2","GO-2024-2664"],"status":"published","title":"ZITADEL's actions can overload reserved claims","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00767,"percentile":0.558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-03-27T19:59:24Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Go","package":"github.com/zitadel/zitadel","fixed_in":["2.42.17","2.43.11","2.44.7","2.45.5","2.46.5","2.47.8","2.48.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.17"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.43.0"},{"fixed":"2.43.11"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.44.0"},{"fixed":"2.44.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.45.0"},{"fixed":"2.45.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.46.0"},{"fixed":"2.46.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.47.0"},{"fixed":"2.47.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.48.0"},{"fixed":"2.48.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.42.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.43.0"},{"fixed":"2.43.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.44.0"},{"fixed":"2.44.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.45.0"},{"fixed":"2.45.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.46.0"},{"fixed":"2.46.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.47.0"},{"fixed":"2.47.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.48.0"},{"fixed":"2.48.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"zitadel","product":"zitadel"}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.42.17","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.43.11","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.44.7","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.45.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.46.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.47.8","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.48.3","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29892","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gp8g-f42f-95q2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29892.json","tags":["advisory"]},{"url":"https://github.com/zitadel/zitadel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-29892","title":"ZITADEL's actions can overload reserved claims","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","status":"published","published":"2024-03-27T19:59:24.734Z","modified":"2024-08-13T14:07:12.217Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-0928","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","status":"published","published":"2024-03-27T19:59:24Z","modified":"2024-08-13T14:07:12Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:19.192984Z"}],"ghsa":[{"id":"GHSA-gp8g-f42f-95q2","title":"ZITADEL's actions can overload reserved claims","description":"### Impact\nUnder certain circumstances an action could set [reserved claims](https://zitadel.com/docs/apis/openidoauth/claims#reserved-claims) managed by ZITADEL.\n\nFor example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`\n\n```json\n{\"urn:zitadel:iam:user:resourceowner:name\": \"ACME\"}\n```\n\nif it was not set by ZITADEL itself.\n\nTo compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`\n\n### Patches\n2.x versions are fixed on \u003e= [2.48.3](https://github.com/zitadel/zitadel/releases/tag/v2.48.3)\n2.47.x versions are fixed on \u003e= [2.47.8](https://github.com/zitadel/zitadel/releases/tag/v2.47.8)\n2.46.x versions are fixed on \u003e= [2.46.5](https://github.com/zitadel/zitadel/releases/tag/v2.46.5)\n2.45.x versions are fixed on \u003e= [2.45.5](https://github.com/zitadel/zitadel/releases/tag/v2.45.5)\n2.44.x versions are fixed on \u003e= [2.44.7](https://github.com/zitadel/zitadel/releases/tag/v2.44.7)\n2.43.x versions are fixed on \u003e= [2.43.11](https://github.com/zitadel/zitadel/releases/tag/v2.43.11)\n2.42.x versions are fixed on \u003e= [2.42.17](https://github.com/zitadel/zitadel/releases/tag/v2.42.17)\n\n### Workarounds\nNo workaround available since a patch is available\n\n### Credits\nMany thanks to @schettn whose disclosure of another topic lead us to find this issue.\n","status":"published","published":"2024-03-28T17:07:32Z","modified":"2024-11-18T16:26:39Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:20.012356Z"}],"nvd":[{"id":"CVE-2024-29892","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","status":"published","published":"2024-03-27T20:15:08.303Z","modified":"2026-06-17T07:23:19.02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"CVE-2024-29892","title":"ZITADEL's actions can overload reserved claims","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.","status":"published","published":"2024-03-27T19:59:24.734Z","modified":"2026-10-28T02:30:20.54071554Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-gp8g-f42f-95q2","title":"ZITADEL's actions can overload reserved claims","description":"### Impact\nUnder certain circumstances an action could set [reserved claims](https://zitadel.com/docs/apis/openidoauth/claims#reserved-claims) managed by ZITADEL.\n\nFor example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`\n\n```json\n{\"urn:zitadel:iam:user:resourceowner:name\": \"ACME\"}\n```\n\nif it was not set by ZITADEL itself.\n\nTo compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`\n\n### Patches\n2.x versions are fixed on \u003e= [2.48.3](https://github.com/zitadel/zitadel/releases/tag/v2.48.3)\n2.47.x versions are fixed on \u003e= [2.47.8](https://github.com/zitadel/zitadel/releases/tag/v2.47.8)\n2.46.x versions are fixed on \u003e= [2.46.5](https://github.com/zitadel/zitadel/releases/tag/v2.46.5)\n2.45.x versions are fixed on \u003e= [2.45.5](https://github.com/zitadel/zitadel/releases/tag/v2.45.5)\n2.44.x versions are fixed on \u003e= [2.44.7](https://github.com/zitadel/zitadel/releases/tag/v2.44.7)\n2.43.x versions are fixed on \u003e= [2.43.11](https://github.com/zitadel/zitadel/releases/tag/v2.43.11)\n2.42.x versions are fixed on \u003e= [2.42.17](https://github.com/zitadel/zitadel/releases/tag/v2.42.17)\n\n### Workarounds\nNo workaround available since a patch is available\n\n### Credits\nMany thanks to @schettn whose disclosure of another topic lead us to find this issue.\n","status":"published","published":"2024-03-28T17:07:32Z","modified":"2026-09-10T03:50:10.441765631Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GO-2024-2664","title":"ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel","description":"ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v2.42.17, from v2.43.0 before v2.43.11, from v2.44.0 before v2.44.7, from v2.45.0 before v2.45.5, from v2.46.0 before v2.46.5, from v2.47.0 before v2.47.8, from v2.48.0 before v2.48.3.","status":"published","published":"2024-06-05T15:10:52Z","modified":"2024-07-09T19:33:56Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}