zitadel vulnerabilities | LiveThreat CVE Feed

Product

zitadel

by zitadel · last CVE Oct 29, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities78 In the news0 Timeline

Severity mix

Critical 10High 36Medium 28Low 4

Severity

All severities78 Critical10 High36 Medium28 Low4

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add zitadel to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-39683	6.5	1%	Jul 3	ZITADEL Vulnerable to Session Information Leakage Affected: = 2.55.0; >= 2.54.0, < 2.54.5; >= 2.53.0, < 2.53.8
CVE-2025-67495	6.1	0%	Dec 9	ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login Affected: < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1
CVE-2024-41953	6.1	1%	Jul 31	Zitadel improperly sanitizes HTML in emails and Console UI Affected: >= 2.52.0, < 2.52.3; >= 2.53.0, < 2.53.9; >= 2.54.0, < 2.54.8; >= 2.55.0, < 2.55.5; >= 2.56.0, < 2.56.2; >= 2.57.0, < 2.57.1; +1 more
CVE-2024-28855	6.1	1%	Mar 18	ZITADEL vulnerable to improper HTML sanitization Affected: < 2.41.15; >= 2.42.0, < 2.42.15; >= 2.43.0, < 2.43.9; >= 2.44.0, < 2.44.3; = 2.45.0; = 2.46.0; +1 more
CVE-2023-22492	5.9	1%	Jan 11	ZITADEL is a combination of Auth0 and Keycloak Affected: 2.0.0 before 2.16.4; 2.17.0 before 2.17.3
CVE-2026-109374	5.5	0%	Oct 12	ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation Affected: 3.0.0 before 4.19.2
CVE-2026-76081	5.5	0%	Sep 14	ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions Affected: < 4.16.0
CVE-2023-46238	5.4	1%	Oct 26	XSS with User Avatar image in ZITADEL Affected: < 2.38.2; >= 2.39.0, < 2.39.2
CVE-2026-105206	5.3	0%	Oct 4	ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service Affected: 4.0.0 before 4.17.3; 3.0.0 through 3.4.15
CVE-2026-33132	5.3	0%	Mar 20	ZITADEL is missing enforcement of organization scopes Affected: >= 4.0.0-rc.1, < 4.12.3; >= 3.0.0-rc.1, < 3.4.9; < 1.80.0-v2.20.0.20260317120401-d90285929ca0
CVE-2026-23511	5.3	0%	Jan 15	ZITADEL has a user enumeration vulnerability in Login UIs Affected: >= 4.0.0, < 4.9.1; < 3.4.6
CVE-2025-57770	5.3	0%	Aug 22	ZITADEL user enumeration vulnerability in login UI Affected: < 2.71.15; >= 3.0.0, < 3.4.0; >= 4.0.0, < 4.0.3
CVE-2025-31124	5.3	1%	Mar 31	Zitadel allows User Enumeration by loginname attribute normalization Affected: >= 2.62.0, < 2.63.9; >= 2.64.0-rc.1, < 2.64.6; >= 2.65.0-rc.1, < 2.65.7; >= 2.66.0-rc.1, < 2.66.16; >= 2.67.0-rc.1, < 2.67.13; >= 2.68.0-rc.1, < 2.68.9; +3 more
CVE-2024-41952	5.3	1%	Jul 31	Zitadel has an "Ignoring unknown usernames" vulnerability Affected: >= 2.53.0, < 2.53.9; >= 2.54.0, < 2.54.8; >= 2.55.0, < 2.55.5; >= 2.56.0, < 2.56.2; >= 2.57.0, < 2.57.1; >= 2.58.0, < 2.58.1
CVE-2024-32967	5.3	1%	May 1	Zitadel exposes internal database user name and host information Affected: < 2.45.7; >= 2.46.0,< 2.46.7; >= 2.47.0, < 2.47.10; >= 2.48.0, < 2.48.5; >= 2.49.0, < 2.49.5; >= 2.50.0, < 2.50.3
CVE-2023-44399	5.3	1%	Oct 10	ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting Affected: < 2.37.3
CVE-2024-49757	4.9	3%	Oct 25	Zitadel User Registration Bypass Vulnerability Affected: >= 2.63, < 2.63.5; >= 2.62, < 2.62.7; >= 2.61, < 2.61.3; >= 2.60, < 2.60.3; >= 2.59, < 2.59.4; < 2.58.6
CVE-2024-29892	4.9	1%	Mar 27	ZITADEL's actions can overload reserved claims Affected: < 2.42.17; >= 2.43.0, < 2.43.11; >= 2.44.0, < 2.44.7; >= 2.45.0, < 2.45.5; >= 2.46.0, < 2.46.5; >= 2.47.0, < 2.47.8; +1 more
CVE-2026-56666	4.8	0%	Jul 10	ZITADEL: Auto-linking by email: IdP-side email verification is not checked Affected: < 4.15.3
CVE-2026-27840	4.3	0%	Feb 26	ZITADEL's truncated opaque tokens are still valid Affected: >= 4.0.0, < 4.11.0; >= 3.0.0, < 3.4.7; >= 2.31.0, <= 2.71.19
CVE-2025-67717	4.3	0%	Dec 11	Zitadel Discloses the Total Number of Instance Users Affected: < 1.80.0-v2.20.0.20251210; >= 2.44.0, < 3.4.5; >= 4.0.0-rc.1, < 4.7.2
CVE-2026-56665	4.2	0%	Jul 10	ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2026-56664	4.2	0%	Jul 10	ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2026-55669	4.2	0%	Jul 10	ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2023-47111	3.7	1%	Nov 8	ZITADEL race condition in lockout policy execution Affected: >= 2.39.0, < 2.40.5; < 2.38.3
CVE-2026-105214	2.3	0%	Oct 4	Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification Affected: before 4.16.2
CVE-2026-55671	2.3	0%	Jul 10	ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components Affected: < 4.15.2
CVE-2026-55670	2.3	0%	Jul 10	ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers Affected: < 4.15.2