Zitadel vulnerabilities

Products

• Zitadel 78

Newest

• zitadel ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval CVE-2026-119129 8.6 HighOctober 29, 2026
• zitadel ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie CVE-2026-119128 9.1 CriticalOctober 29, 2026
• zitadel ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection CVE-2026-119127 8.6 HighOctober 29, 2026
• zitadel ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation CVE-2026-109374 5.1 MediumOctober 12, 2026
• zitadel ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie CVE-2026-109373 9.2 CriticalOctober 12, 2026
• zitadel ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion CVE-2026-109372 9.3 CriticalOctober 12, 2026
• zitadel ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 CVE-2026-109371 8.8 HighOctober 12, 2026
• zitadel ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback CVE-2026-105215 9.3 CriticalOctober 4, 2026
• zitadel Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification CVE-2026-105214 2.3 LowOctober 4, 2026
• zitadel ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations CVE-2026-105213 8.8 HighOctober 4, 2026
• zitadel ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment CVE-2026-105212 8.7 HighOctober 4, 2026
• zitadel ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode CVE-2026-105211 9.2 CriticalOctober 4, 2026
• zitadel ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers CVE-2026-105210 8.8 HighOctober 4, 2026
• zitadel ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment CVE-2026-105209 9.3 CriticalOctober 4, 2026
• zitadel ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens CVE-2026-105208 8.7 HighOctober 4, 2026
• zitadel ZITADEL before 4.17.3 Account Takeover via External IdP Linking CVE-2026-105207 9.3 CriticalOctober 4, 2026
• zitadel ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service CVE-2026-105206 5.3 MediumOctober 4, 2026
• zitadel ZITADEL: MFA bypass via session reuse in Login V2 CVE-2026-85056 Fix available 8.2 HighSeptember 24, 2026
• zitadel ZITADEL: Actions V1 sandbox escape: host file read via require() CVE-2026-85057 Fix available 8.7 HighSeptember 24, 2026
• zitadel ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions CVE-2026-76081 Fix available 5.5 MediumSeptember 14, 2026
• zitadel ZITADEL Users Can Self-Verify Email/Phone via API CVE-2026-54693 Fix available 8.2 HighJuly 29, 2026
• zitadel ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange CVE-2026-56668 Fix available 8.1 HighJuly 10, 2026
• zitadel ZITADEL: Auto-linking by email: IdP-side email verification is not checked CVE-2026-56666 Fix available 4.8 MediumJuly 10, 2026
• zitadel ZITADEL: Stored XSS via Default URI Redirect in Login V2 CVE-2026-56667 7.3 HighJuly 10, 2026
• zitadel ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider CVE-2026-56665 Fix available 4.2 MediumJuly 10, 2026
• zitadel ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider CVE-2026-55669 Fix available 4.2 MediumJune 18, 2026
• zitadel ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider CVE-2026-56664 Fix available 4.2 MediumJune 18, 2026
• zitadel ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) CVE-2026-55672 Fix available 7.4 HighJune 18, 2026
• zitadel ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers CVE-2026-55670 Fix available 2.3 LowJune 18, 2026
• zitadel ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components CVE-2026-55671 Fix available 2.3 LowJune 18, 2026
• zitadel ZITADEL: LDAP Filter Injection in Login Flow CVE-2026-44671 Fix available 7.5 HighMay 8, 2026
• zitadel ZITADEL is missing enforcement of organization scopes CVE-2026-33132 Fix available 5.3 MediumMarch 18, 2026
• zitadel ZITADEL: Reactivation of Expired Passkey Registration Codes CVE-2026-32132 7.4 HighMarch 11, 2026
• zitadel ZITADEL Cross-Tenant Information Disclosure in Management API CVE-2026-32131 7.7 HighMarch 11, 2026
• zitadel ZITADEL SCIM Authentication Bypass via URL Encoding CVE-2026-32130 7.5 HighMarch 11, 2026
• zitadel ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover CVE-2026-29192 Fix available 7.7 HighMarch 4, 2026
• zitadel ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVE-2026-29193 Fix available 8.2 HighMarch 4, 2026
• zitadel ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint CVE-2026-29191 Fix available 9.3 CriticalMarch 4, 2026
• zitadel ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API CVE-2026-27946 Fix available 8.2 HighFebruary 26, 2026
• zitadel ZITADEL has potential SSRF via Actions CVE-2026-27945 Fix available 2.1 LowFebruary 26, 2026
• zitadel ZITADEL's truncated opaque tokens are still valid CVE-2026-27840 Fix available 4.3 MediumFebruary 26, 2026
• zitadel ZITADEL has a user enumeration vulnerability in Login UIs CVE-2026-23511 Fix available 5.3 MediumJanuary 15, 2026
• zitadel Zitadel Discloses the Total Number of Instance Users CVE-2025-67717 Fix available 5.3 MediumDecember 10, 2025
• zitadel ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login CVE-2025-67495 Fix available 8.0 HighDecember 8, 2025
• zitadel ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login CVE-2026-29067 Fix available 8.1 HighDecember 8, 2025
• zitadel ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVE-2025-67494 Public exploitFix available 9.3 CriticalDecember 8, 2025
• zitadel ZITADEL vulnerable to Account Takeover with deactivated Instance IdP CVE-2025-64717 Fix available 7.4 HighNovember 13, 2025
• zitadel IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering CVE-2025-64431 Fix available 8.7 HighNovember 5, 2025
• zitadel Zitadel Bypass Second Authentication Factor CVE-2025-64103 Fix available 8.7 HighOctober 29, 2025
• zitadel Zitadel allows brute-forcing authentication factors CVE-2025-64102 Fix available 7.7 HighOctober 29, 2025
• Show olderLoading…