Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: zitadel 4.19.5 Clear all filters
TI-2026-82647 CVE-2026-119129 · GHSA-4j7m-6fr6-j463

ZITADEL Login V2 flaw lets attackers approve device authorizations

Priority MEDIUM 45

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without c…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00284 Published 2026-10-29 Fixed in 4.19.5 CWE-862
TI-2026-82646 CVE-2026-119128 · GHSA-vc67-2j7f-xv7j

Authentication bypass in ZITADEL Login V2 enables account takeover

Priority MEDIUM 41

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00285 Published 2026-10-29 Fixed in 4.19.5 CWE-565
TI-2026-82645 CVE-2026-119127 · GHSA-47m4-8jqx-5r73

Host header injection in ZITADEL Login V2 enables account takeover

Priority LOW 39

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00278 Published 2026-10-29 Fixed in 4.19.5 CWE-640