Read the docs
TI-2024-27975 Aliases CVE-2024-41953GHSA-v333-7h2p-5fhv

Zitadel improperly sanitizes HTML in emails and Console UI

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0065 51st percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 2.52.3, 2.53.9, 2.54.8 +4github.com/zitadel/zitadel (Go): 2.52.3, 2.53.9, 2.54.8 +6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadel2.52.0 to before 2.52.3; 2.53.0 to before 2.53.9; 2.54.0 to before 2.54.8; 2.55.0 to before 2.55.5; 2.56.0 to before 2.56.2; 2.57.0 to before 2.57.1; 2.58.0 to before 2.58.12.52.3, 2.53.9, 2.54.8, 2.55.5, 2.56.2, 2.57.1, 2.58.1Patch availableCNA
—github.com/zitadel/zitadel (Go)1.80.1 to before 2.52.32.52.3Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.53.0 to before 2.53.92.53.9Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.54.0 to before 2.54.82.54.8Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.55.0 to before 2.55.52.55.5Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.56.0 to before 2.56.22.56.2Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.57.0 to before 2.57.12.57.1Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)2.58.0 to before 2.58.12.58.1Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)before 0.0.0-20240731122110-189505c80fa60.0.0-20240731122110-189505c80fa6Patch availableGHSA-v333-7h2p-5fhv
—github.com/zitadel/zitadel (Go)0.0.0 to before 1.80.0-v2.20.0.20240731122110-189505c80fa61.80.0-v2.20.0.20240731122110-189505c80fa6Patch availableGHSA-v333-7h2p-5fhv
  • zitadel Vendorzitadel Affected 2.52.0 to before 2.52.3; 2.53.0 to before 2.53.9; 2.54.0 to before 2.54.8; 2.55.0 to before 2.55.5; 2.56.0 to before 2.56.2; 2.57.0 to before 2.57.1; 2.58.0 to before 2.58.1 Fixed in 2.52.3, 2.53.9, 2.54.8, 2.55.5, 2.56.2, 2.57.1, 2.58.1 Patch available CNA
  • github.com/zitadel/zitadel (Go) Vendor— Affected 1.80.1 to before 2.52.3 Fixed in 2.52.3 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.53.0 to before 2.53.9 Fixed in 2.53.9 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.54.0 to before 2.54.8 Fixed in 2.54.8 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.55.0 to before 2.55.5 Fixed in 2.55.5 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.56.0 to before 2.56.2 Fixed in 2.56.2 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.57.0 to before 2.57.1 Fixed in 2.57.1 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.58.0 to before 2.58.1 Fixed in 2.58.1 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected before 0.0.0-20240731122110-189505c80fa6 Fixed in 0.0.0-20240731122110-189505c80fa6 Patch available GHSA-v333-7h2p-5fhv
  • github.com/zitadel/zitadel (Go) Vendor— Affected 0.0.0 to before 1.80.0-v2.20.0.20240731122110-189505c80fa6 Fixed in 1.80.0-v2.20.0.20240731122110-189505c80fa6 Patch available GHSA-v333-7h2p-5fhv

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*2.52.0 to before 2.52.3; 2.53.0 to before 2.53.9; 2.54.0 to before 2.54.8; 2.55.0 to before 2.55.5; 2.56.0 to before 2.56.2Vulnerablezitadel
cpe:2.3:a:zitadel:zitadel:2.57.0:-:*:*:*:*:*:*2.57.0Vulnerablezitadel
cpe:2.3:a:zitadel:zitadel:2.57.0:rc1:*:*:*:*:*:*2.57.0 rc1Vulnerablezitadel
cpe:2.3:a:zitadel:zitadel:2.57.0:rc2:*:*:*:*:*:*2.57.0 rc2Vulnerablezitadel
cpe:2.3:a:zitadel:zitadel:2.58.0:*:*:*:*:*:*:*2.58.0Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 2.52.0 to before 2.52.3; 2.53.0 to before 2.53.9; 2.54.0 to before 2.54.8; 2.55.0 to before 2.55.5; 2.56.0 to before 2.56.2 Vulnerable ·zitadel
  • cpe:2.3:a:zitadel:zitadel:2.57.0:-:*:*:*:*:*:* Versions 2.57.0 Vulnerable ·zitadel
  • cpe:2.3:a:zitadel:zitadel:2.57.0:rc1:*:*:*:*:*:* Versions 2.57.0 rc1 Vulnerable ·zitadel
  • cpe:2.3:a:zitadel:zitadel:2.57.0:rc2:*:*:*:*:*:* Versions 2.57.0 rc2 Vulnerable ·zitadel
  • cpe:2.3:a:zitadel:zitadel:2.58.0:*:*:*:*:*:*:* Versions 2.58.0 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 2.52.3, 2.53.9, 2.54.8, 2.55.5, 2.56.2, 2.57.1, 2.58.1
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.52.3 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.53.9 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.54.8 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.55.5 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.56.2 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.57.1 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 2.58.1 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 0.0.0-20240731122110-189505c80fa6 Advisory →
  • Fix · GHSA-v333-7h2p-5fhv github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20240731122110-189505c80fa6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41953
  2. 2026-10-03 Alias added: GHSA-v333-7h2p-5fhv
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 7

Advisory 2

Other 9

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences