Skip to contentZitadel Zitadel vulnerabilities
- zitadelZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization ApprovalCVE-2026-1191298.6 High
- zitadelZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck CookieCVE-2026-1191289.1 Critical
- zitadelZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header InjectionCVE-2026-1191278.6 High
- zitadelZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange ImpersonationCVE-2026-1093745.1 Medium
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session CookieCVE-2026-1093739.2 Critical
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionCVE-2026-109372Public exploit9.3 Critical
- zitadelZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1CVE-2026-1093718.8 High
- zitadelZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP CallbackCVE-2026-1052159.3 Critical
- zitadelZitadel before 4.16.2 SSRF via Organization Domain HTTP VerificationCVE-2026-1052142.3 Low
- zitadelZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated OrganizationsCVE-2026-1052138.8 High
- zitadelZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey EnrollmentCVE-2026-1052128.7 High
- zitadelZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodeCVE-2026-1052119.2 Critical
- zitadelZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init HandlersCVE-2026-1052108.8 High
- zitadelZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey EnrollmentCVE-2026-1052099.3 Critical
- zitadelZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent TokensCVE-2026-1052088.7 High
- zitadelZITADEL before 4.17.3 Account Takeover via External IdP LinkingCVE-2026-1052079.3 Critical
- zitadelZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User ServiceCVE-2026-1052065.3 Medium
- zitadelZITADEL: MFA bypass via session reuse in Login V2CVE-2026-85056Fix available8.2 High
- zitadelZITADEL: Actions V1 sandbox escape: host file read via require()CVE-2026-85057Fix available8.7 High
- zitadelZITADEL: Improper Role Revocation on Granted Projects during Multiple Role DeletionsCVE-2026-76081Fix available5.5 Medium
- zitadelZITADEL Users Can Self-Verify Email/Phone via APICVE-2026-54693Fix available8.2 High
- zitadelZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeCVE-2026-56668Fix available8.1 High
- zitadelZITADEL: Auto-linking by email: IdP-side email verification is not checkedCVE-2026-56666Fix available4.8 Medium
- zitadelZITADEL: Stored XSS via Default URI Redirect in Login V2CVE-2026-566677.3 High
- zitadelZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderCVE-2026-56665Fix available4.2 Medium
- zitadelZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderCVE-2026-55669Fix available4.2 Medium
- zitadelZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderCVE-2026-56664Fix available4.2 Medium
- zitadelZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)CVE-2026-55672Fix available7.4 High
- zitadelZITADEL: Cross-Tenant User Leakage via Recycled IdentifiersCVE-2026-55670Fix available2.3 Low
- zitadelZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP ComponentsCVE-2026-55671Fix available2.3 Low
- zitadelZITADEL: LDAP Filter Injection in Login FlowCVE-2026-44671Fix available7.5 High
- zitadelZITADEL is missing enforcement of organization scopesCVE-2026-33132Fix available5.3 Medium
- zitadelZITADEL: Reactivation of Expired Passkey Registration CodesCVE-2026-321327.4 High
- zitadelZITADEL Cross-Tenant Information Disclosure in Management APICVE-2026-321317.7 High
- zitadelZITADEL SCIM Authentication Bypass via URL EncodingCVE-2026-321307.5 High
- zitadelZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverCVE-2026-29192Fix available7.7 High
- zitadelZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2CVE-2026-29193Fix available8.2 High
- zitadelZITADEL: 1-Click Account Takeover via XSS in /saml-post EndpointCVE-2026-29191Fix available9.3 Critical
- zitadelZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APICVE-2026-27946Fix available8.2 High
- zitadelZITADEL has potential SSRF via ActionsCVE-2026-27945Fix available2.1 Low
- zitadelZITADEL's truncated opaque tokens are still validCVE-2026-27840Fix available4.3 Medium
- zitadelZITADEL has a user enumeration vulnerability in Login UIsCVE-2026-23511Fix available5.3 Medium
- zitadelZitadel Discloses the Total Number of Instance UsersCVE-2025-67717Fix available5.3 Medium
- zitadelZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginCVE-2025-67495Fix available8.0 High
- zitadelZITADEL: Account Takeover Due to Improper Instance Validation in V2 LoginCVE-2026-29067Fix available8.1 High
- zitadelZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 LoginCVE-2025-67494Public exploitFix available9.3 Critical
- zitadelZITADEL vulnerable to Account Takeover with deactivated Instance IdPCVE-2025-64717Fix available7.4 High
- zitadelIDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data TemperingCVE-2025-64431Fix available8.7 High
- zitadelZitadel Bypass Second Authentication FactorCVE-2025-64103Fix available8.7 High
- zitadelZitadel allows brute-forcing authentication factorsCVE-2025-64102Fix available7.7 High
- Show olderLoading…