Zitadel vulnerabilities
78 CVEs and advisories name Zitadel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119129ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
- CVE-2026-119128ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
- CVE-2026-119127ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
- CVE-2026-109374ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
- CVE-2026-109373ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
- CVE-2026-109372ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
- CVE-2026-109371ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
- CVE-2026-105215ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
- CVE-2026-105214Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
- CVE-2026-105213ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
- CVE-2026-105212ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
- CVE-2026-105211ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
- CVE-2026-105210ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
- CVE-2026-105209ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
- CVE-2026-105208ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
- CVE-2026-105207ZITADEL before 4.17.3 Account Takeover via External IdP Linking
- CVE-2026-105206ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
- CVE-2026-85056ZITADEL: MFA bypass via session reuse in Login V2
- CVE-2026-85057ZITADEL: Actions V1 sandbox escape: host file read via require()
- CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
- CVE-2026-54693ZITADEL Users Can Self-Verify Email/Phone via API
- CVE-2026-56668ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
- CVE-2026-56666ZITADEL: Auto-linking by email: IdP-side email verification is not checked
- CVE-2026-56667ZITADEL: Stored XSS via Default URI Redirect in Login V2
- CVE-2026-56665ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
- CVE-2026-56664ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
- CVE-2026-55672ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
- CVE-2026-55671ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
- CVE-2026-55670ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
- CVE-2026-55669ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider