Login Request a demo
ZI
Product
zitadel
by zitadel · last CVE Oct 29, 2026
78
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Vulnerabilities78In the news0Timeline
Severity mix
Critical 10High 36Medium 28Low 4
Severity
All severities78Critical10High36Medium28Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add zitadel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105207
9.8
0%
Oct 4
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
Affected: 4.0.0 before 4.17.3; 3.0.0 through 3.4.15
CVE-2025-64717
9.8
0%
Nov 13
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
Affected: >= 4.0.0-rc.1, < 4.6.6; >= 3.0.0-rc.1, < 3.4.4; >= 2.50.0, < 2.71.19
CVE-2025-64103
9.8
0%
Oct 29
Zitadel Bypass Second Authentication Factor
Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.55.0, < 2.71.18; >= 2.54.3, <= 2.54.10; >= 2.53.6, <= 2.53.9
CVE-2025-64102
9.8
0%
Oct 29
Zitadel allows brute-forcing authentication factors
Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18
CVE-2026-105209
9.6
0%
Oct 4
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
Affected: 4.0.0 before 4.17.1; before 3.4.15
CVE-2026-29067
9.3
0%
Mar 7
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
Affected: >= 4.0.0-rc.1, < 4.7.1
CVE-2026-29191
9.3
0%
Mar 7
ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
Affected: >= 4.0.0, < 4.12.0
CVE-2026-105215
9.1
0%
Oct 4
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
Affected: 4.0.0 before 4.16.2; before 3.4.14
CVE-2024-49753
9.1
1%
Oct 25
Denied Host Validation Bypass in Zitadel Actions
Affected: >= 2.64, < 2.64.1; >= 2.63, < 2.63.6; >= 2.62, < 2.62.8; >= 2.61, < 2.61.4; >= 2.60, < 2.60.4; >= 2.59, < 2.59.5; +1 more
CVE-2025-27507
9.0
1%
Mar 4
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
Affected: >= 2.63.0-rc.1, < 2.63.8; >= 2.64.0-rc.1, < 2.64.5; >= 2.66.0-rc.1, < 2.66.11; >= 2.67.0-rc.1, < 2.67.8; >= 2.68.0-rc.1, < 2.68.4; >= 2.69.0-rc.1, < 2.69.4; +2 more
Showing 10