Skip to contentZitadel vulnerabilities
Newest
- zitadelZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionCVE-2025-64101Fix available8.1 High
- zitadelZITADEL user enumeration vulnerability in login UICVE-2025-577705.3 Medium
- zitadelZITADEL has broken authN and authZ in session API and resulting session tokensCVE-2025-538957.7 High
- zitadelZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header InjectionCVE-2025-48936Fix available8.1 High
- zitadelZITADEL Allows IdP Intent Token ReuseCVE-2025-46815Fix available8.0 High
- zitadelZitadel allows User Enumeration by loginname attribute normalizationCVE-2025-311245.3 Medium
- zitadelZitadel Expired JWT Keys Usable for Authorization GrantsCVE-2025-311238.7 High
- zitadelIDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP ConfigurationsCVE-2025-27507Fix available9.0 Critical
- zitadelZitadel User Registration Bypass VulnerabilityCVE-2024-49757Fix available7.5 High
- zitadelDenied Host Validation Bypass in Zitadel ActionsCVE-2024-49753Fix available5.9 Medium
- zitadelUnauthorized Access After Organization or Project Deactivation in ZitadelCVE-2024-47060Fix available4.3 Medium
- zitadelService Users Deactivation not Working in ZitadelCVE-2024-47000Fix available8.1 High
- zitadelUser Grant Deactivation not Working in ZitadelCVE-2024-46999Fix available7.3 High
- zitadelZitadel improperly sanitizes HTML in emails and Console UICVE-2024-41953Fix available4.3 Medium
- zitadelZitadel has an "Ignoring unknown usernames" vulnerabilityCVE-2024-41952Fix available5.3 Medium
- zitadelZITADEL Vulnerable to Session Information LeakageCVE-2024-39683Fix available5.7 Medium
- zitadelZitadel exposes internal database user name and host informationCVE-2024-32967Fix available5.3 Medium
- zitadelZITADEL's Improper Lockout Mechanism Leads to MFA BypassCVE-2024-32868Public exploitFix available6.5 Medium
- zitadelZITADEL's actions can overload reserved claimsCVE-2024-29892Fix available6.1 Medium
- zitadelZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP BypassCVE-2024-29891Fix available8.7 High
- zitadelZITADEL vulnerable to improper HTML sanitizationCVE-2024-28855Fix available8.1 High
- zitadelAccount Takeover via Session Fixation in Zitadel [Bypassing MFA]CVE-2024-28197Fix available7.5 High
- zitadelZITADEL vulnerable account takeover via malicious host header injectionCVE-2023-49097Fix available8.1 High
- zitadelZITADEL race condition in lockout policy executionCVE-2023-47111Fix available7.3 High
- zitadelXSS with User Avatar image in ZITADELCVE-2023-462388.7 High
- zitadelZITADEL's password reset does not respect the "Ignoring unknown usernames" settingCVE-2023-44399Fix available5.3 Medium
- zitadelRefreshToken invalidation vulnerabilityCVE-2023-22492Fix available5.9 Medium
- zitadelBroken Authorization in ZITADEL ActionsCVE-2022-36051Fix available8.7 High