Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: zitadel 4.16.2 Clear all filters
TI-2026-67551 CVE-2026-105215 · GHSA-639g-x9rp-hw3x

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

Priority MEDIUM 48

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields witho…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00339 Published 2026-10-04 Fixed in 4.16.2, 3.4.14 CWE-290
TI-2026-67550 CVE-2026-105214 · GHSA-66r9-3738-gxmw

Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

Priority LOW 11

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-04 Fixed in 4.16.2 CWE-918
TI-2026-67548 CVE-2026-105212 · GHSA-4727-2r9w-rpch

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

Priority LOW 38

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00321 Published 2026-10-04 Fixed in 4.16.2, 3.4.14 CWE-287