Login Request a demo
ZI
Vendor
zitadel
1 product with CVEs on record
78
CVEs
0
On KEV
17
New 30D
Products
ZI
zitadel
zitadel
9.8
78 CVEs0 on KEV17 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-119129
New
ZI
zitadel
zitadel
8.1–Oct 29ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
CVE-2026-119128
New
ZI
zitadel
zitadel
7.4–Oct 29ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
CVE-2026-119127
New
ZI
zitadel
zitadel
8.1–Oct 29ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
CVE-2026-109374
ZI
zitadel
zitadel
5.5
0%
Oct 12ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
CVE-2026-109373
ZI
zitadel
zitadel
8.1
0%
Oct 12ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
CVE-2026-109372
ZI
zitadel
zitadel
8.7
0%
Oct 12ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
CVE-2026-109371
ZI
zitadel
zitadel
8.2
0%
Oct 12ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
CVE-2026-105215
ZI
zitadel
zitadel
9.1
0%
Oct 4ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
CVE-2026-105214
ZI
zitadel
zitadel
2.3
0%
Oct 4Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
CVE-2026-105213
ZI
zitadel
zitadel
8.2
0%
Oct 4ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
CVE-2026-105212
ZI
zitadel
zitadel
7.5
0%
Oct 4ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
CVE-2026-105211
ZI
zitadel
zitadel
8.1
0%
Oct 4ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
CVE-2026-105210
ZI
zitadel
zitadel
8.2
0%
Oct 4ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
CVE-2026-105209
ZI
zitadel
zitadel
9.6
0%
Oct 4ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
CVE-2026-105208
ZI
zitadel
zitadel
7.7
0%
Oct 4ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
CVE-2026-105207
ZI
zitadel
zitadel
9.8
0%
Oct 4ZITADEL before 4.17.3 Account Takeover via External IdP Linking
CVE-2026-105206
ZI
zitadel
zitadel
5.3
0%
Oct 4ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
CVE-2026-85056
ZI
zitadel
zitadel
8.2
0%
Sep 24ZITADEL: MFA bypass via session reuse in Login V2
CVE-2026-85057
ZI
zitadel
zitadel
8.7
0%
Sep 24ZITADEL: Actions V1 sandbox escape: host file read via require()
CVE-2026-76081
ZI
zitadel
zitadel
5.5
0%
Sep 14ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
CVE-2026-54693
ZI
zitadel
zitadel
8.2
1%
Jul 29ZITADEL Users Can Self-Verify Email/Phone via API
CVE-2026-56668
ZI
zitadel
zitadel
8.1
0%
Jul 10ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-56666
ZI
zitadel
zitadel
4.8
0%
Jul 10ZITADEL: Auto-linking by email: IdP-side email verification is not checked
CVE-2026-56667
ZI
zitadel
zitadel
7.3
0%
Jul 10ZITADEL: Stored XSS via Default URI Redirect in Login V2
CVE-2026-56665
ZI
zitadel
zitadel
4.2
0%
Jul 10ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
CVE-2026-56664
ZI
zitadel
zitadel
4.2
0%
Jul 10ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
CVE-2026-55672
ZI
zitadel
zitadel
7.4
0%
Jul 10ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
CVE-2026-55671
ZI
zitadel
zitadel
2.3
0%
Jul 10ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
CVE-2026-55670
ZI
zitadel
zitadel
2.3
0%
Jul 10ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
CVE-2026-55669
ZI
zitadel
zitadel
4.2
0%
Jul 10ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
CVE-2026-44671
ZI
zitadel
zitadel
7.5
0%
May 14ZITADEL: LDAP Filter Injection in Login Flow
CVE-2026-33132
ZI
zitadel
zitadel
5.3
0%
Mar 20ZITADEL is missing enforcement of organization scopes
CVE-2026-32132
ZI
zitadel
zitadel
7.4
0%
Mar 11ZITADEL: Reactivation of Expired Passkey Registration Codes
CVE-2026-32131
ZI
zitadel
zitadel
7.7
0%
Mar 11ZITADEL Cross-Tenant Information Disclosure in Management API
CVE-2026-32130
ZI
zitadel
zitadel
7.5
1%
Mar 11ZITADEL SCIM Authentication Bypass via URL Encoding
CVE-2026-29067
ZI
zitadel
zitadel
9.3
0%
Mar 7ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
CVE-2026-29193
ZI
zitadel
zitadel
8.2
0%
Mar 7ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2
CVE-2026-29192
ZI
zitadel
zitadel
7.7
0%
Mar 7ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
CVE-2026-29191
ZI
zitadel
zitadel
9.3
0%
Mar 7ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
CVE-2026-27946
ZI
zitadel
zitadel
6.5
0%
Feb 26ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
CVE-2026-27945
ZI
zitadel
zitadel
6.5
0%
Feb 26ZITADEL has potential SSRF via Actions
CVE-2026-27840
ZI
zitadel
zitadel
4.3
0%
Feb 26ZITADEL's truncated opaque tokens are still valid
CVE-2026-23511
ZI
zitadel
zitadel
5.3
0%
Jan 15ZITADEL has a user enumeration vulnerability in Login UIs
CVE-2025-67717
ZI
zitadel
zitadel
4.3
0%
Dec 11Zitadel Discloses the Total Number of Instance Users
CVE-2025-67495
ZI
zitadel
zitadel
6.1
0%
Dec 9ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
CVE-2025-67494
ZI
zitadel
zitadel
8.6
0%
Dec 9ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
CVE-2025-64717
ZI
zitadel
zitadel
9.8
0%
Nov 13ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
CVE-2025-64431
ZI
zitadel
zitadel
8.7
0%
Nov 7IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
CVE-2025-64103
ZI
zitadel
zitadel
9.8
0%
Oct 29Zitadel Bypass Second Authentication Factor
CVE-2025-64102
ZI
zitadel
zitadel
9.8
0%
Oct 29Zitadel allows brute-forcing authentication factors
CVE-2025-64101
ZI
zitadel
zitadel
8.8
0%
Oct 29ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
CVE-2025-57770
ZI
zitadel
zitadel
5.3
0%
Aug 22ZITADEL user enumeration vulnerability in login UI
CVE-2025-53895
ZI
zitadel
zitadel
8.8
0%
Jul 15ZITADEL has broken authN and authZ in session API and resulting session tokens
CVE-2025-48936
ZI
zitadel
zitadel
8.8
0%
May 30ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
CVE-2025-46815
ZI
zitadel
zitadel
8.0
0%
May 6ZITADEL Allows IdP Intent Token Reuse
CVE-2025-31124
ZI
zitadel
zitadel
5.3
1%
Mar 31Zitadel allows User Enumeration by loginname attribute normalization
CVE-2025-31123
ZI
zitadel
zitadel
8.7
0%
Mar 31Zitadel Expired JWT Keys Usable for Authorization Grants
CVE-2025-27507
ZI
zitadel
zitadel
9.0
1%
Mar 4IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
CVE-2024-49757
ZI
zitadel
zitadel
4.9
3%
Oct 25Zitadel User Registration Bypass Vulnerability
CVE-2024-49753
ZI
zitadel
zitadel
9.1
1%
Oct 25Denied Host Validation Bypass in Zitadel Actions