Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: zitadel 3.4.15 Clear all filters
TI-2026-67546 CVE-2026-105210 · GHSA-j55w-p4wc-frwh

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

Priority MEDIUM 44

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any prim…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00236 Published 2026-10-04 Fixed in 4.17.1, 3.4.15 CWE-287
TI-2026-67545 CVE-2026-105209 · GHSA-hcch-574x-xrm8

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

Priority LOW 39

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not…

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-10-04 Fixed in 4.17.1, 3.4.15 CWE-862