Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: zitadel 4.17.3 Clear all filters
TI-2026-67544 CVE-2026-105208 · GHSA-xv85-7fx2-46j9

ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

Priority LOW 38

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's ext…

CVSS 4.0HIGH 8.7 Network Low privileges User interaction EPSS 0.00081 Published 2026-10-04 Fixed in 4.17.3 CWE-649
TI-2026-67543 CVE-2026-105207 · GHSA-98x8-wvr5-pxqj

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

Priority MEDIUM 48

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0031 Published 2026-10-04 Fixed in 4.17.3 CWE-306
TI-2026-67542 CVE-2026-105206 · GHSA-pmw5-r3fq-5gm7

ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

Priority LOW 24

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the targ…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-04 Fixed in 4.17.3 CWE-863