Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: zitadel 3.4.14 Clear all filters
TI-2026-67551 CVE-2026-105215 · GHSA-639g-x9rp-hw3x

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

Priority MEDIUM 48

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields witho…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00339 Published 2026-10-04 Fixed in 4.16.2, 3.4.14 CWE-290
TI-2026-67548 CVE-2026-105212 · GHSA-4727-2r9w-rpch

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

Priority LOW 38

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00321 Published 2026-10-04 Fixed in 4.16.2, 3.4.14 CWE-287