ZI
Product
zitadel
78
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Severity mix
Critical 10High 36Medium 28Low 4
Watch
Add zitadel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27946 | 6.5 | Feb 26 | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API Affected: >= 4.0.0, < 4.11.0; < 3.4.7 |
| CVE-2026-27945 | 6.5 | Feb 26 | ZITADEL has potential SSRF via Actions Affected: >= 2.59.0, < 4.11.1 |
| CVE-2024-46999 | 6.5 | Sep 19 | User Grant Deactivation not Working in Zitadel Affected: >= 2.62.0, < 2.62.1; >= 2.61.0, < 2.61.1; >= 2.60.0, < 2.60.2; >= 2.59.0, < 2.59.3; >= 2.58.0, < 2.58.5; >= 2.57.0, < 2.57.5; +3 more |
| CVE-2024-47060 | 6.5 | Sep 19 | Unauthorized Access After Organization or Project Deactivation in Zitadel Affected: >= 2.62.0, < 2.62.1; >= 2.61.0, < 2.61.1; >= 2.60.0, < 2.60.2; >= 2.59.0, < 2.59.3; >= 2.58.0, < 2.58.5; >= 2.57.0, < 2.57.5; +3 more |
| CVE-2024-39683 | 6.5 | Jul 3 | ZITADEL Vulnerable to Session Information Leakage Affected: = 2.55.0; >= 2.54.0, < 2.54.5; >= 2.53.0, < 2.53.8 |
| CVE-2025-67495 | 6.1 | Dec 9 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login Affected: < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 |
| CVE-2024-41953 | 6.1 | Jul 31 | Zitadel improperly sanitizes HTML in emails and Console UI Affected: >= 2.52.0, < 2.52.3; >= 2.53.0, < 2.53.9; >= 2.54.0, < 2.54.8; >= 2.55.0, < 2.55.5; >= 2.56.0, < 2.56.2; >= 2.57.0, < 2.57.1; +1 more |
| CVE-2024-28855 | 6.1 | Mar 18 | ZITADEL vulnerable to improper HTML sanitization Affected: < 2.41.15; >= 2.42.0, < 2.42.15; >= 2.43.0, < 2.43.9; >= 2.44.0, < 2.44.3; = 2.45.0; = 2.46.0; +1 more |
| CVE-2023-22492 | 5.9 | Jan 11 | ZITADEL is a combination of Auth0 and Keycloak Affected: 2.0.0 before 2.16.4; 2.17.0 before 2.17.3 |
| CVE-2026-109374 | 5.5 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation Affected: 3.0.0 before 4.19.2 |
| CVE-2026-76081 | 5.5 | Sep 14 | ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions Affected: < 4.16.0 |
| CVE-2023-46238 | 5.4 | Oct 26 | XSS with User Avatar image in ZITADEL Affected: < 2.38.2; >= 2.39.0, < 2.39.2 |
| CVE-2026-105206 | 5.3 | Oct 4 | ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service Affected: 4.0.0 before 4.17.3; 3.0.0 through 3.4.15 |
| CVE-2026-33132 | 5.3 | Mar 20 | ZITADEL is missing enforcement of organization scopes Affected: >= 4.0.0-rc.1, < 4.12.3; >= 3.0.0-rc.1, < 3.4.9; < 1.80.0-v2.20.0.20260317120401-d90285929ca0 |
| CVE-2026-23511 | 5.3 | Jan 15 | ZITADEL has a user enumeration vulnerability in Login UIs Affected: >= 4.0.0, < 4.9.1; < 3.4.6 |
| CVE-2025-57770 | 5.3 | Aug 22 | ZITADEL user enumeration vulnerability in login UI Affected: < 2.71.15; >= 3.0.0, < 3.4.0; >= 4.0.0, < 4.0.3 |
| CVE-2025-31124 | 5.3 | Mar 31 | Zitadel allows User Enumeration by loginname attribute normalization Affected: >= 2.62.0, < 2.63.9; >= 2.64.0-rc.1, < 2.64.6; >= 2.65.0-rc.1, < 2.65.7; >= 2.66.0-rc.1, < 2.66.16; >= 2.67.0-rc.1, < 2.67.13; >= 2.68.0-rc.1, < 2.68.9; +3 more |
| CVE-2024-41952 | 5.3 | Jul 31 | Zitadel has an "Ignoring unknown usernames" vulnerability Affected: >= 2.53.0, < 2.53.9; >= 2.54.0, < 2.54.8; >= 2.55.0, < 2.55.5; >= 2.56.0, < 2.56.2; >= 2.57.0, < 2.57.1; >= 2.58.0, < 2.58.1 |
| CVE-2024-32967 | 5.3 | May 1 | Zitadel exposes internal database user name and host information Affected: < 2.45.7; >= 2.46.0,< 2.46.7; >= 2.47.0, < 2.47.10; >= 2.48.0, < 2.48.5; >= 2.49.0, < 2.49.5; >= 2.50.0, < 2.50.3 |
| CVE-2023-44399 | 5.3 | Oct 10 | ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting Affected: < 2.37.3 |
| CVE-2024-49757 | 4.9 | Oct 25 | Zitadel User Registration Bypass Vulnerability Affected: >= 2.63, < 2.63.5; >= 2.62, < 2.62.7; >= 2.61, < 2.61.3; >= 2.60, < 2.60.3; >= 2.59, < 2.59.4; < 2.58.6 |
| CVE-2024-29892 | 4.9 | Mar 27 | ZITADEL's actions can overload reserved claims Affected: < 2.42.17; >= 2.43.0, < 2.43.11; >= 2.44.0, < 2.44.7; >= 2.45.0, < 2.45.5; >= 2.46.0, < 2.46.5; >= 2.47.0, < 2.47.8; +1 more |
| CVE-2026-56666 | 4.8 | Jul 10 | ZITADEL: Auto-linking by email: IdP-side email verification is not checked Affected: < 4.15.3 |
| CVE-2026-27840 | 4.3 | Feb 26 | ZITADEL's truncated opaque tokens are still valid Affected: >= 4.0.0, < 4.11.0; >= 3.0.0, < 3.4.7; >= 2.31.0, <= 2.71.19 |
| CVE-2025-67717 | 4.3 | Dec 11 | Zitadel Discloses the Total Number of Instance Users Affected: < 1.80.0-v2.20.0.20251210; >= 2.44.0, < 3.4.5; >= 4.0.0-rc.1, < 4.7.2 |
| CVE-2026-56665 | 4.2 | Jul 10 | ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 |
| CVE-2026-56664 | 4.2 | Jul 10 | ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 |
| CVE-2026-55669 | 4.2 | Jul 10 | ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 |
Showing 28