Read the docs

zitadel

Records78All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical12CVSS 9.0–10.0
CVSS high41CVSS 7.0–8.9

Exploited now

zitadel records in CISA KEV

No zitadel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Zitadel 47 records MEDIUM

Records

78 records

TI-2024-26607 CVE-2024-39683 · GHSA-cvw9-c57h-3397

ZITADEL Vulnerable to Session Information Leakage

Priority MEDIUM 62

ZITADEL is an open-source identity infrastructure tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2024-07-03 Fixed in 2.54.5, 2.53.8 +1 CWE-200
TI-2026-67551 CVE-2026-105215 · GHSA-639g-x9rp-hw3x

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

Priority MEDIUM 48

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields witho…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00339 Published 2026-10-04 Fixed in 4.16.2, 3.4.14 CWE-290
TI-2026-67543 CVE-2026-105207 · GHSA-98x8-wvr5-pxqj

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

Priority MEDIUM 48

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0031 Published 2026-10-04 Fixed in 4.17.3 CWE-306
TI-2025-39554 CVE-2025-64103 · GHSA-cfjq-28r2-4jv5

Zitadel Bypass Second Authentication Factor

Priority MEDIUM 46

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00352 Published 2025-10-29 Fixed in 4.6.0, 3.4.3 +2 CWE-287
TI-2026-82647 CVE-2026-119129 · GHSA-4j7m-6fr6-j463

ZITADEL Login V2 flaw lets attackers approve device authorizations

Priority MEDIUM 45

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without c…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00284 Published 2026-10-29 Fixed in 4.19.5 CWE-862
TI-2026-71183 CVE-2026-109371 · GHSA-2464-29qv-3mj7

Missing authentication in ZITADEL Login V1 lets attackers rename users

Priority MEDIUM 44

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00363 Published 2026-10-12 Fixed in 4.18.0 CWE-306
TI-2026-67546 CVE-2026-105210 · GHSA-j55w-p4wc-frwh

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

Priority MEDIUM 44

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any prim…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00236 Published 2026-10-04 Fixed in 4.17.1, 3.4.15 CWE-287
TI-2024-33224 CVE-2024-49757 · GHSA-3rmw-76m6-4gjc

Zitadel User Registration Bypass Vulnerability

Priority MEDIUM 44

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02518 Published 2024-10-25 Fixed in 2.63.5, 2.62.7 +8 CWE-287
TI-2024-31388 CVE-2024-47000 · GHSA-qr2h-7pwm-h393

Service Users Deactivation not Working in Zitadel

Priority MEDIUM 43

Zitadel is an open source identity management platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00411 Published 2024-09-19 Fixed in 2.62.1, 2.61.1 +7 CWE-269
TI-2026-71185 CVE-2026-109373 · GHSA-ff7c-8692-c559

ZITADEL Login V2 Account Takeover via Unsigned Session Cookie

Priority MEDIUM 42

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00423 Published 2026-10-12 Fixed in 4.19.2 CWE-441
TI-2026-71184 CVE-2026-109372 · GHSA-65fv-6pff-4q47

Authentication bypass in ZITADEL SAML login enables account takeover

Priority MEDIUM 42

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but res…

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.0037 Published 2026-10-12 Fixed in 4.19.2 CWE-287
TI-2026-67547 CVE-2026-105211 · GHSA-mq63-7hcv-jfrc

ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

Priority MEDIUM 42

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00333 Published 2026-10-04 Fixed in 4.17.1 CWE-200
TI-2024-33220 CVE-2024-49753 · GHSA-6cf5-w9h3-4rqv

Denied Host Validation Bypass in Zitadel Actions

Priority MEDIUM 42

Zitadel is open-source identity infrastructure software.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00652 Published 2024-10-25 Fixed in 2.64.1, 2.63.6 +7 CWE-20
TI-2022-16474 CVE-2022-36051 · GHSA-c8fj-4pm8-mp2c

Broken Authorization in ZITADEL Actions

Priority MEDIUM 42

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create J…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0101 Published 2022-08-31 Fixed in 2.2.0, 1.87.1 CWE-436
TI-2026-82646 CVE-2026-119128 · GHSA-vc67-2j7f-xv7j

Authentication bypass in ZITADEL Login V2 enables account takeover

Priority MEDIUM 41

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00285 Published 2026-10-29 Fixed in 4.19.5 CWE-565
TI-2026-58435 CVE-2026-85056 · GHSA-9993-rfwp-rhwf

ZITADEL: MFA bypass via session reuse in Login V2

Priority MEDIUM 41

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00285 Published 2026-09-24 Fixed in 4.16.1, 1.80.0-v2.20.0.20260717062356-56f4798ed31f CWE-287
Load more
Open these records in search →