Vulnerabilities

TI-2026-32571 CVE-2026-44671 · GHSA-rxvx-hhpj-q6px

ZITADEL: LDAP Filter Injection in Login Flow

LOW 39

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2026-05-14 Fixed in 3.4.10, 4.15.0 CWE-90

TI-2026-25563 CVE-2026-33132 · GHSA-g2pf-ww5m-2r9m

ZITADEL is missing enforcement of organization scopes

LOW 30

ZITADEL is an open source identity management platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00322 Published 2026-03-20 Partial fix · 4.12.3, 3.4.9 +1 CWE-863

TI-2026-24669 CVE-2026-32132

ZITADEL: Reactivation of Expired Passkey Registration Codes

LOW 35

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00453 Published 2026-03-11 Fixed in 4.12.2, 3.4.8 CWE-613

TI-2026-24668 CVE-2026-32131

ZITADEL Cross-Tenant Information Disclosure in Management API

LOW 34

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00447 Published 2026-03-11 Fixed in 4.12.2, 3.4.8 CWE-639

TI-2026-24667 CVE-2026-32130

ZITADEL SCIM Authentication Bypass via URL Encoding

MEDIUM 40

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00664 Published 2026-03-11 Fixed in 4.12.2, 3.4.8 CWE-288

TI-2026-23212 CVE-2026-29067 · GHSA-pfrf-9r5f-73f5

ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

MEDIUM 42

ZITADEL is an open source identity management platform.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00372 Published 2026-03-07 Fixed in 4.7.1, 1.80.0-v2.20.0.20251208091519-4c879b47334e CWE-601

TI-2026-23310 CVE-2026-29193 · GHSA-25rw-g6ff-fmg8

ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2

MEDIUM 42

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00352 Published 2026-03-07 Fixed in 4.12.1 CWE-287

TI-2026-23309 CVE-2026-29192 · GHSA-6rx5-m2rc-hmf7

ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

LOW 36

ZITADEL is an open source identity management platform.

CVSS 3.1HIGH 7.7 Network High privileges No interaction EPSS 0.00351 Published 2026-03-07 Fixed in 4.12.0 CWE-79

TI-2026-23308 CVE-2026-29191 · GHSA-pr34-2v5x-6qjq

ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

MEDIUM 42

ZITADEL is an open source identity management platform.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00455 Published 2026-03-07 Fixed in 4.12.0 CWE-79

TI-2026-22290 CVE-2026-27946 · GHSA-282g-fhmx-xf54

ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API

MEDIUM 41

ZITADEL is an open source identity management platform.

CVSS 4.0HIGH 8.2 Network No auth User interaction EPSS 0.00218 Published 2026-02-26 Fixed in 4.11.0, 3.4.7 +2 CWE-862

TI-2026-22289 CVE-2026-27945 · GHSA-7777-fhq9-592v

ZITADEL has potential SSRF via Actions

LOW 11

ZITADEL is an open source identity management platform.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00257 Published 2026-02-26 Fixed in 4.11.1, 1.80.0-v2.20.0.20260225053328-b2532e966621 CWE-918

TI-2026-22191 CVE-2026-27840 · GHSA-6mq3-xmgp-pjm5

ZITADEL's truncated opaque tokens are still valid

LOW 19

ZITADEL is an open source identity management platform.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00159 Published 2026-02-26 Fixed in 4.11.0, 3.4.7 +1 CWE-302

TI-2026-18935 CVE-2026-23511 · GHSA-pvm5-9frx-264r

ZITADEL has a user enumeration vulnerability in Login UIs

LOW 30

ZITADEL is an open source identity management platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00402 Published 2026-01-15 Fixed in 4.9.1, 3.4.6 CWE-204

TI-2025-41413 CVE-2025-67717 · GHSA-f4cf-9rvr-2rcx

Zitadel Discloses the Total Number of Instance Users

LOW 23

ZITADEL is an open-source identity infrastructure tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00222 Published 2025-12-11 Fixed in 1.80.0-v2.20.0.20251210, 3.4.5 +2 CWE-497

TI-2025-41254 CVE-2025-67495 · GHSA-v959-qxv6-6f8p

ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login

LOW 37

ZITADEL is an open-source identity infrastructure tool.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.003 Published 2025-12-09 Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1 CWE-79

TI-2025-41253 CVE-2025-67494 · GHSA-7wfc-4796-gmg5

ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

MEDIUM 46

ZITADEL is an open-source identity infrastructure tool.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00444 Published 2025-12-09 Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1 CWE-918

TI-2025-40063 CVE-2025-64717 · GHSA-j4g7-v4m4-77px

ZITADEL vulnerable to Account Takeover with deactivated Instance IdP

LOW 35

ZITADEL is an open source identity management platform.

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00495 Published 2025-11-13 Fixed in 4.6.6, 3.4.4 +2 CWE-287

TI-2025-39554 CVE-2025-64103 · GHSA-cfjq-28r2-4jv5

Zitadel Bypass Second Authentication Factor

MEDIUM 46

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00352 Published 2025-10-29 Fixed in 4.6.0, 3.4.3 +2 CWE-287

TI-2025-39553 CVE-2025-64102 · GHSA-xrw9-r35x-x878

Zitadel allows brute-forcing authentication factors

LOW 36

Zitadel is open-source identity infrastructure software.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0037 Published 2025-10-29 Fixed in 4.6.0, 3.4.3 +2 CWE-307

TI-2025-39552 CVE-2025-64101 · GHSA-mwmh-7px9-4c23

ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection

MEDIUM 40

Zitadel is open-source identity infrastructure software.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00363 Published 2025-10-29 Fixed in 4.6.0, 3.4.3 +2 CWE-601

TI-2025-35655 CVE-2025-57770

ZITADEL user enumeration vulnerability in login UI

LOW 24

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00391 Published 2025-08-22 Fixed in 2.71.15, 3.4.0 +1 CWE-203

TI-2025-33769 CVE-2025-53895

ZITADEL has broken authN and authZ in session API and resulting session tokens

LOW 36

ZITADEL is an open source identity management system.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00413 Published 2025-07-15 Fixed in 3.3.1, 2.70.14 +1 CWE-384

TI-2025-31074 CVE-2025-48936 · GHSA-93m4-mfpg-c3xf

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

MEDIUM 40

Zitadel is open-source identity infrastructure software.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00411 Published 2025-05-30 Fixed in 2.70.12, 3.2.2 +2 CWE-601

TI-2025-29448 CVE-2025-46815 · GHSA-g4r8-mp7g-85fq

ZITADEL Allows IdP Intent Token Reuse

LOW 35

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00471 Published 2025-05-06 Fixed in 3.0.0, 2.70.10 +1 CWE-294

TI-2025-22385 CVE-2025-31124

Zitadel allows User Enumeration by loginname attribute normalization

LOW 31

Zitadel is open-source identity infrastructure software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00527 Published 2025-03-31 Fixed in 2.63.9, 2.64.6 +7 CWE-200

Vulnerabilities

Filters