Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: zitadel 4.17.1 Clear all filters
TI-2026-67547 CVE-2026-105211 · GHSA-mq63-7hcv-jfrc

ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

Priority MEDIUM 42

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00333 Published 2026-10-04 Fixed in 4.17.1 CWE-200
TI-2026-67546 CVE-2026-105210 · GHSA-j55w-p4wc-frwh

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

Priority MEDIUM 44

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any prim…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00236 Published 2026-10-04 Fixed in 4.17.1, 3.4.15 CWE-287
TI-2026-67545 CVE-2026-105209 · GHSA-hcch-574x-xrm8

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

Priority LOW 39

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not…

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-10-04 Fixed in 4.17.1, 3.4.15 CWE-862