ZI
Product
zitadel
78
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Severity mix
Critical 10High 36Medium 28Low 4
Watch
Add zitadel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105207 | 9.8 | Oct 4 | ZITADEL before 4.17.3 Account Takeover via External IdP Linking Affected: 4.0.0 before 4.17.3; 3.0.0 through 3.4.15 |
| CVE-2025-64717 | 9.8 | Nov 13 | ZITADEL vulnerable to Account Takeover with deactivated Instance IdP Affected: >= 4.0.0-rc.1, < 4.6.6; >= 3.0.0-rc.1, < 3.4.4; >= 2.50.0, < 2.71.19 |
| CVE-2025-64103 | 9.8 | Oct 29 | Zitadel Bypass Second Authentication Factor Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.55.0, < 2.71.18; >= 2.54.3, <= 2.54.10; >= 2.53.6, <= 2.53.9 |
| CVE-2025-64102 | 9.8 | Oct 29 | Zitadel allows brute-forcing authentication factors Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18 |
| CVE-2026-105209 | 9.6 | Oct 4 | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment Affected: 4.0.0 before 4.17.1; before 3.4.15 |
| CVE-2026-29067 | 9.3 | Mar 7 | ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login Affected: >= 4.0.0-rc.1, < 4.7.1 |
| CVE-2026-29191 | 9.3 | Mar 7 | ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint Affected: >= 4.0.0, < 4.12.0 |
| CVE-2026-105215 | 9.1 | Oct 4 | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback Affected: 4.0.0 before 4.16.2; before 3.4.14 |
| CVE-2024-49753 | 9.1 | Oct 25 | Denied Host Validation Bypass in Zitadel Actions Affected: >= 2.64, < 2.64.1; >= 2.63, < 2.63.6; >= 2.62, < 2.62.8; >= 2.61, < 2.61.4; >= 2.60, < 2.60.4; >= 2.59, < 2.59.5; +1 more |
| CVE-2025-27507 | 9.0 | Mar 4 | IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations Affected: >= 2.63.0-rc.1, < 2.63.8; >= 2.64.0-rc.1, < 2.64.5; >= 2.66.0-rc.1, < 2.66.11; >= 2.67.0-rc.1, < 2.67.8; >= 2.68.0-rc.1, < 2.68.4; >= 2.69.0-rc.1, < 2.69.4; +2 more |
| CVE-2025-64101 | 8.8 | Oct 29 | ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18 |
| CVE-2025-53895 | 8.8 | Jul 15 | ZITADEL has broken authN and authZ in session API and resulting session tokens Affected: = 4.0.0-rc.1; >= 3.0.0, < 3.3.1; >= 2.53.0, < 2.70.14; >= 2.71.0, < 2.71.13 |
| CVE-2025-48936 | 8.8 | May 30 | ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection Affected: < 2.70.12; >= 2.71.0, <= 2.71.10; >= 3.0.0-rc1, < 3.2.2 |
| CVE-2023-49097 | 8.8 | Nov 30 | ZITADEL vulnerable account takeover via malicious host header injection Affected: >= 2.39.0, < 2.39.9; >= 2.40.0, < 2.40.10; >= 2.41.0, < 2.41.6 |
| CVE-2022-36051 | 8.8 | Aug 31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users… Affected: 1.42.0 before 1.87.1; 2.0.0 before 2.2.0 |
| CVE-2026-109372 | 8.7 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion Affected: 3.0.0 before 4.19.2 |
| CVE-2026-85057 | 8.7 | Sep 24 | ZITADEL: Actions V1 sandbox escape: host file read via require() Affected: >= 3.0.0, < 3.4.13; >= 4.0.0, < 4.16.1 |
| CVE-2025-64431 | 8.7 | Nov 7 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering Affected: >= 4.0.0-rc.1, < 4.6.3; >= 1.80.0-v2.20.0.20250414095945-f365cee73242, < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 |
| CVE-2025-31123 | 8.7 | Mar 31 | Zitadel Expired JWT Keys Usable for Authorization Grants Affected: >= 2.62.0, < 2.63.9; >= 2.64.0-rc.1, < 2.64.6; >= 2.65.0-rc.1, < 2.65.7; >= 2.66.0-rc.1, < 2.66.16; >= 2.67.0-rc.1, < 2.67.13; >= 2.68.0-rc.1, < 2.68.9; +3 more |
| CVE-2024-29891 | 8.7 | Mar 27 | ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass Affected: < 2.42.17; >= 2.43.0, < 2.43.11; >= 2.44.0, < 2.44.7; >= 2.45.0, < 2.45.5; >= 2.46.0, < 2.46.5; >= 2.47.0, < 2.47.8; +1 more |
| CVE-2025-67494 | 8.6 | Dec 9 | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login Affected: < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 |
| CVE-2026-109371 | 8.2 | Oct 12 | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 Affected: 3.0.0 before 4.18.0 |
| CVE-2026-105213 | 8.2 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations Affected: before 4.17.1 |
| CVE-2026-105210 | 8.2 | Oct 4 | ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers Affected: 4.0.0 before 4.17.1; before 3.4.15 |
| CVE-2026-85056 | 8.2 | Sep 24 | ZITADEL: MFA bypass via session reuse in Login V2 Affected: >= 4.0.0, < 4.16.1 |
| CVE-2026-54693 | 8.2 | Jul 29 | ZITADEL Users Can Self-Verify Email/Phone via API Affected: >= 2.43.0, <= 2.71.19; >= 3.0.0-rc.1, < 3.4.11; >= 4.0.0-rc.1, < 4.15.1 |
| CVE-2026-29193 | 8.2 | Mar 7 | ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 Affected: >= 4.0.0, < 4.12.1 |
| CVE-2026-119129 New | 8.1 | Oct 29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval Affected: 4.0.0 before 4.19.5; 3.0.0 through 3.4.15 |
| CVE-2026-119127 New | 8.1 | Oct 29 | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection Affected: 4.0.0 before 4.19.5 |
| CVE-2026-109373 | 8.1 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie Affected: 3.0.0 before 4.19.2 |
| CVE-2026-105211 | 8.1 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode Affected: before 4.17.1 |
| CVE-2026-56668 | 8.1 | Jul 10 | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange Affected: < 4.15.3 |
| CVE-2024-32868 | 8.1 | Apr 25 | ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass Affected: < 2.50.0 |
| CVE-2025-46815 | 8.0 | May 6 | ZITADEL Allows IdP Intent Token Reuse Affected: >= 3.0.0-rc.1, < 3.0.0; < 2.70.10; >= 2.71.0, < 2.71.9 |
| CVE-2026-105208 | 7.7 | Oct 4 | ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens Affected: 4.0.0 before 4.17.3; 3.0.0 through 3.4.15 |
| CVE-2026-32131 | 7.7 | Mar 11 | ZITADEL Cross-Tenant Information Disclosure in Management API Affected: >= 4.0.0, < 4.12.2; < 3.4.8 |
| CVE-2026-29192 | 7.7 | Mar 7 | ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover Affected: >= 4.0.0, < 4.12.0 |
| CVE-2026-105212 | 7.5 | Oct 4 | ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment Affected: 4.0.0 before 4.16.2; before 3.4.14 |
| CVE-2026-44671 | 7.5 | May 14 | ZITADEL: LDAP Filter Injection in Login Flow Affected: >= 2.71.11, < 3.4.10; >= 4.0.0, < 4.15.0 |
| CVE-2026-32130 | 7.5 | Mar 11 | ZITADEL SCIM Authentication Bypass via URL Encoding Affected: >= 4.0.0, < 4.12.2; >= 2.68.0, < 3.4.8 |
| CVE-2024-47000 | 7.5 | Sep 19 | Service Users Deactivation not Working in Zitadel Affected: >= 2.62.0, < 2.62.1; >= 2.61.0, < 2.61.1; >= 2.60.0, < 2.60.2; >= 2.59.0, < 2.59.3; >= 2.58.0, < 2.58.5; >= 2.57.0, < 2.57.5; +3 more |
| CVE-2024-28197 | 7.5 | Mar 11 | Account Takeover via Session Fixation in Zitadel [Bypassing MFA] Affected: < 2.44.3; >= 2.45.0, < 2.45.1 |
| CVE-2026-119128 New | 7.4 | Oct 29 | ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie Affected: 4.0.0 before 4.19.5 |
| CVE-2026-55672 | 7.4 | Jul 10 | ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 |
| CVE-2026-32132 | 7.4 | Mar 11 | ZITADEL: Reactivation of Expired Passkey Registration Codes Affected: >= 4.0.0, < 4.12.2; < 3.4.8 |
| CVE-2026-56667 | 7.3 | Jul 10 | ZITADEL: Stored XSS via Default URI Redirect in Login V2 Affected: < 4.15.3 |
| CVE-2026-27946 | 6.5 | Feb 26 | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API Affected: >= 4.0.0, < 4.11.0; < 3.4.7 |
| CVE-2026-27945 | 6.5 | Feb 26 | ZITADEL has potential SSRF via Actions Affected: >= 2.59.0, < 4.11.1 |
| CVE-2024-46999 | 6.5 | Sep 19 | User Grant Deactivation not Working in Zitadel Affected: >= 2.62.0, < 2.62.1; >= 2.61.0, < 2.61.1; >= 2.60.0, < 2.60.2; >= 2.59.0, < 2.59.3; >= 2.58.0, < 2.58.5; >= 2.57.0, < 2.57.5; +3 more |
| CVE-2024-47060 | 6.5 | Sep 19 | Unauthorized Access After Organization or Project Deactivation in Zitadel Affected: >= 2.62.0, < 2.62.1; >= 2.61.0, < 2.61.1; >= 2.60.0, < 2.60.2; >= 2.59.0, < 2.59.3; >= 2.58.0, < 2.58.5; >= 2.57.0, < 2.57.5; +3 more |