Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: zitadel 4.19.2 Clear all filters
TI-2026-71186 CVE-2026-109374 · GHSA-7j9c-5h49-hq7h

Privilege escalation in ZITADEL via OIDC token exchange impersonation

Priority LOW 23

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation c…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00209 Published 2026-10-12 Fixed in 4.19.2 CWE-863
TI-2026-71185 CVE-2026-109373 · GHSA-ff7c-8692-c559

ZITADEL Login V2 Account Takeover via Unsigned Session Cookie

Priority MEDIUM 42

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00423 Published 2026-10-12 Fixed in 4.19.2 CWE-441
TI-2026-71184 CVE-2026-109372 · GHSA-65fv-6pff-4q47

Authentication bypass in ZITADEL SAML login enables account takeover

Priority MEDIUM 42

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but res…

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.0037 Published 2026-10-12 Fixed in 4.19.2 CWE-287