Read the docs
TI-2026-23309 Aliases CVE-2026-29192GHSA-6rx5-m2rc-hmf7

ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 4.12.0github.com/zitadel/zitadel/v2 (Go): 4.12.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadel4.0.0 to before 4.12.04.12.0Patch availableCNA
—github.com/zitadel/zitadel/v2 (Go)4.0.0 to before 4.12.04.12.0Patch availableGHSA-6rx5-m2rc-hmf7
—github.com/zitadel/zitadel (Go)4.0.0 to before 4.12.04.12.0Patch availableGHSA-6rx5-m2rc-hmf7
  • zitadel Vendorzitadel Affected 4.0.0 to before 4.12.0 Fixed in 4.12.0 Patch available CNA
  • github.com/zitadel/zitadel/v2 (Go) Vendor— Affected 4.0.0 to before 4.12.0 Fixed in 4.12.0 Patch available GHSA-6rx5-m2rc-hmf7
  • github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0 to before 4.12.0 Fixed in 4.12.0 Patch available GHSA-6rx5-m2rc-hmf7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*4.0.0 to before 4.12.0Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.12.0 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 4.12.0
  • Fix · GHSA-6rx5-m2rc-hmf7 github.com/zitadel/zitadel/v2 (Go) Fixed in 4.12.0 Advisory →
  • Fix · GHSA-6rx5-m2rc-hmf7 github.com/zitadel/zitadel (Go) Fixed in 4.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29192
  2. 2026-10-03 Alias added: GHSA-6rx5-m2rc-hmf7

References

Patch 1

Advisory 1

Other 2

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences