Read the docs

zitadel

Records78All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical12CVSS 9.0–10.0
CVSS high41CVSS 7.0–8.9

Exploited now

zitadel records in CISA KEV

No zitadel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Zitadel 47 records MEDIUM

Records

47 records in Zitadel · all components

TI-2024-26607 CVE-2024-39683 · GHSA-cvw9-c57h-3397

ZITADEL Vulnerable to Session Information Leakage

Priority MEDIUM 62

ZITADEL is an open-source identity infrastructure tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2024-07-03 Fixed in 2.54.5, 2.53.8 +1 CWE-200
TI-2025-39554 CVE-2025-64103 · GHSA-cfjq-28r2-4jv5

Zitadel Bypass Second Authentication Factor

Priority MEDIUM 46

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00352 Published 2025-10-29 Fixed in 4.6.0, 3.4.3 +2 CWE-287
TI-2024-33224 CVE-2024-49757 · GHSA-3rmw-76m6-4gjc

Zitadel User Registration Bypass Vulnerability

Priority MEDIUM 44

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02518 Published 2024-10-25 Fixed in 2.63.5, 2.62.7 +8 CWE-287
TI-2024-31388 CVE-2024-47000 · GHSA-qr2h-7pwm-h393

Service Users Deactivation not Working in Zitadel

Priority MEDIUM 43

Zitadel is an open source identity management platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00411 Published 2024-09-19 Fixed in 2.62.1, 2.61.1 +7 CWE-269
TI-2024-33220 CVE-2024-49753 · GHSA-6cf5-w9h3-4rqv

Denied Host Validation Bypass in Zitadel Actions

Priority MEDIUM 42

Zitadel is open-source identity infrastructure software.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00652 Published 2024-10-25 Fixed in 2.64.1, 2.63.6 +7 CWE-20
TI-2022-16474 CVE-2022-36051 · GHSA-c8fj-4pm8-mp2c

Broken Authorization in ZITADEL Actions

Priority MEDIUM 42

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create J…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0101 Published 2022-08-31 Fixed in 2.2.0, 1.87.1 CWE-436
TI-2023-24865 CVE-2023-46238

XSS with User Avatar image in ZITADEL

Priority MEDIUM 40

ZITADEL is an identity infrastructure management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0052 Published 2023-10-26 Fixed in 2.38.2, 2.39.2 CWE-79
TI-2026-32571 CVE-2026-44671 · GHSA-rxvx-hhpj-q6px

ZITADEL: LDAP Filter Injection in Login Flow

Priority LOW 39

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2026-05-14 Fixed in 3.4.10, 4.15.0 CWE-90
TI-2024-19057 CVE-2024-28855 · GHSA-hfrg-4jwr-jfpj

ZITADEL vulnerable to improper HTML sanitization

Priority LOW 39

ZITADEL, open source authentication management software, uses Go templates to render the login UI.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00779 Published 2024-03-18 Fixed in 2.41.15, 2.42.15 +7 CWE-20
Load more
Open these records in search →