# cve.now: Zitadel

The newest entries naming Zitadel as an affected vendor (up to 200), of 78 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119129](https://cve.now/CVE-2026-119129.md): ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval (CVSS 8.6)
- [CVE-2026-119128](https://cve.now/CVE-2026-119128.md): ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie (CVSS 9.1)
- [CVE-2026-119127](https://cve.now/CVE-2026-119127.md): ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection (CVSS 8.6)
- [CVE-2026-109374](https://cve.now/CVE-2026-109374.md): ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation (CVSS 5.1)
- [CVE-2026-109373](https://cve.now/CVE-2026-109373.md): ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie (CVSS 9.2)
- [CVE-2026-109372](https://cve.now/CVE-2026-109372.md): ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion (CVSS 9.3)
- [CVE-2026-109371](https://cve.now/CVE-2026-109371.md): ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 (CVSS 8.8)
- [CVE-2026-105215](https://cve.now/CVE-2026-105215.md): ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback (CVSS 9.3)
- [CVE-2026-105214](https://cve.now/CVE-2026-105214.md): Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification (CVSS 2.3)
- [CVE-2026-105213](https://cve.now/CVE-2026-105213.md): ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations (CVSS 8.8)
- [CVE-2026-105212](https://cve.now/CVE-2026-105212.md): ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment (CVSS 8.7)
- [CVE-2026-105211](https://cve.now/CVE-2026-105211.md): ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode (CVSS 9.2)
- [CVE-2026-105210](https://cve.now/CVE-2026-105210.md): ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers (CVSS 8.8)
- [CVE-2026-105209](https://cve.now/CVE-2026-105209.md): ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment (CVSS 9.3)
- [CVE-2026-105208](https://cve.now/CVE-2026-105208.md): ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens (CVSS 8.7)
- [CVE-2026-105207](https://cve.now/CVE-2026-105207.md): ZITADEL before 4.17.3 Account Takeover via External IdP Linking (CVSS 9.3)
- [CVE-2026-105206](https://cve.now/CVE-2026-105206.md): ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service (CVSS 5.3)
- [CVE-2026-85056](https://cve.now/CVE-2026-85056.md): ZITADEL: MFA bypass via session reuse in Login V2 (CVSS 8.2)
- [CVE-2026-85057](https://cve.now/CVE-2026-85057.md): ZITADEL: Actions V1 sandbox escape: host file read via require() (CVSS 8.7)
- [CVE-2026-76081](https://cve.now/CVE-2026-76081.md): ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions (CVSS 5.5)
- [CVE-2026-54693](https://cve.now/CVE-2026-54693.md): ZITADEL Users Can Self-Verify Email/Phone via API (CVSS 8.2)
- [CVE-2026-56668](https://cve.now/CVE-2026-56668.md): ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange (CVSS 8.1)
- [CVE-2026-56666](https://cve.now/CVE-2026-56666.md): ZITADEL: Auto-linking by email: IdP-side email verification is not checked (CVSS 4.8)
- [CVE-2026-56667](https://cve.now/CVE-2026-56667.md): ZITADEL: Stored XSS via Default URI Redirect in Login V2 (CVSS 7.3)
- [CVE-2026-56665](https://cve.now/CVE-2026-56665.md): ZITADEL: Missing Token Expiration (\`exp\`) Validation in JWT IdP Provider (CVSS 4.2)
- [CVE-2026-56664](https://cve.now/CVE-2026-56664.md): ZITADEL: Missing Token Lifecyle Validation (\`exp\` and \`iat\`) in JWT IdP Provider (CVSS 4.2)
- [CVE-2026-55672](https://cve.now/CVE-2026-55672.md): ZITADEL: Missing client\_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) (CVSS 7.4)
- [CVE-2026-55671](https://cve.now/CVE-2026-55671.md): ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components (CVSS 2.3)
- [CVE-2026-55670](https://cve.now/CVE-2026-55670.md): ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers (CVSS 2.3)
- [CVE-2026-55669](https://cve.now/CVE-2026-55669.md): ZITADEL: Missing Token Audience Validation (\`aud\`) in JWT IdP Provider (CVSS 4.2)
- [CVE-2026-44671](https://cve.now/CVE-2026-44671.md): ZITADEL: LDAP Filter Injection in Login Flow (CVSS 7.5)
- [CVE-2026-33132](https://cve.now/CVE-2026-33132.md): ZITADEL is missing enforcement of organization scopes (CVSS 5.3)
- [CVE-2026-32132](https://cve.now/CVE-2026-32132.md): ZITADEL: Reactivation of Expired Passkey Registration Codes (CVSS 7.4)
- [CVE-2026-32131](https://cve.now/CVE-2026-32131.md): ZITADEL Cross-Tenant Information Disclosure in Management API (CVSS 7.7)
- [CVE-2026-32130](https://cve.now/CVE-2026-32130.md): ZITADEL SCIM Authentication Bypass via URL Encoding (CVSS 7.5)
- [CVE-2026-29067](https://cve.now/CVE-2026-29067.md): ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login (CVSS 8.1)
- [CVE-2026-29193](https://cve.now/CVE-2026-29193.md): ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 (CVSS 8.2)
- [CVE-2026-29192](https://cve.now/CVE-2026-29192.md): ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover (CVSS 7.7)
- [CVE-2026-29191](https://cve.now/CVE-2026-29191.md): ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint (CVSS 9.3)
- [CVE-2026-27946](https://cve.now/CVE-2026-27946.md): ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API (CVSS 8.2)
- [CVE-2026-27945](https://cve.now/CVE-2026-27945.md): ZITADEL has potential SSRF via Actions (CVSS 2.1)
- [CVE-2026-27840](https://cve.now/CVE-2026-27840.md): ZITADEL's truncated opaque tokens are still valid (CVSS 4.3)
- [CVE-2026-23511](https://cve.now/CVE-2026-23511.md): ZITADEL has a user enumeration vulnerability in Login UIs (CVSS 5.3)
- [CVE-2025-67717](https://cve.now/CVE-2025-67717.md): Zitadel Discloses the Total Number of Instance Users (CVSS 5.3)
- [CVE-2025-67495](https://cve.now/CVE-2025-67495.md): ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login (CVSS 8.0)
- [CVE-2025-67494](https://cve.now/CVE-2025-67494.md): ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login (CVSS 9.3)
- [CVE-2025-64717](https://cve.now/CVE-2025-64717.md): ZITADEL vulnerable to Account Takeover with deactivated Instance IdP (CVSS 7.4)
- [CVE-2025-64431](https://cve.now/CVE-2025-64431.md): IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering (CVSS 8.7)
- [CVE-2025-64103](https://cve.now/CVE-2025-64103.md): Zitadel Bypass Second Authentication Factor (CVSS 8.7)
- [CVE-2025-64102](https://cve.now/CVE-2025-64102.md): Zitadel allows brute-forcing authentication factors (CVSS 7.7)
- [CVE-2025-64101](https://cve.now/CVE-2025-64101.md): ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection (CVSS 8.1)
- [CVE-2025-57770](https://cve.now/CVE-2025-57770.md): ZITADEL user enumeration vulnerability in login UI (CVSS 5.3)
- [CVE-2025-53895](https://cve.now/CVE-2025-53895.md): ZITADEL has broken authN and authZ in session API and resulting session tokens (CVSS 7.7)
- [CVE-2025-48936](https://cve.now/CVE-2025-48936.md): ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection (CVSS 8.1)
- [CVE-2025-46815](https://cve.now/CVE-2025-46815.md): ZITADEL Allows IdP Intent Token Reuse (CVSS 8.0)
- [CVE-2025-31124](https://cve.now/CVE-2025-31124.md): Zitadel allows User Enumeration by loginname attribute normalization (CVSS 5.3)
- [CVE-2025-31123](https://cve.now/CVE-2025-31123.md): Zitadel Expired JWT Keys Usable for Authorization Grants (CVSS 8.7)
- [CVE-2025-27507](https://cve.now/CVE-2025-27507.md): IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations (CVSS 9.0)
- [CVE-2024-49757](https://cve.now/CVE-2024-49757.md): Zitadel User Registration Bypass Vulnerability (CVSS 7.5)
- [CVE-2024-49753](https://cve.now/CVE-2024-49753.md): Denied Host Validation Bypass in Zitadel Actions (CVSS 5.9)
- [CVE-2024-46999](https://cve.now/CVE-2024-46999.md): User Grant Deactivation not Working in Zitadel (CVSS 7.3)
- [CVE-2024-47000](https://cve.now/CVE-2024-47000.md): Service Users Deactivation not Working in Zitadel (CVSS 8.1)
- [CVE-2024-47060](https://cve.now/CVE-2024-47060.md): Unauthorized Access After Organization or Project Deactivation in Zitadel (CVSS 4.3)
- [CVE-2024-41953](https://cve.now/CVE-2024-41953.md): Zitadel improperly sanitizes HTML in emails and Console UI (CVSS 4.3)
- [CVE-2024-41952](https://cve.now/CVE-2024-41952.md): Zitadel has an "Ignoring unknown usernames" vulnerability (CVSS 5.3)
- [CVE-2024-39683](https://cve.now/CVE-2024-39683.md): ZITADEL Vulnerable to Session Information Leakage (CVSS 5.7)
- [CVE-2024-32967](https://cve.now/CVE-2024-32967.md): Zitadel exposes internal database user name and host information (CVSS 5.3)
- [CVE-2024-32868](https://cve.now/CVE-2024-32868.md): ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass (CVSS 6.5)
- [CVE-2024-29892](https://cve.now/CVE-2024-29892.md): ZITADEL's actions can overload reserved claims (CVSS 6.1)
- [CVE-2024-29891](https://cve.now/CVE-2024-29891.md): ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass (CVSS 8.7)
- [CVE-2024-28855](https://cve.now/CVE-2024-28855.md): ZITADEL vulnerable to improper HTML sanitization (CVSS 8.1)
- [CVE-2024-28197](https://cve.now/CVE-2024-28197.md): Account Takeover via Session Fixation in Zitadel \[Bypassing MFA\] (CVSS 7.5)
- [CVE-2023-49097](https://cve.now/CVE-2023-49097.md): ZITADEL vulnerable account takeover via malicious host header injection (CVSS 8.1)
- [CVE-2023-47111](https://cve.now/CVE-2023-47111.md): ZITADEL race condition in lockout policy execution (CVSS 7.3)
- [CVE-2023-46238](https://cve.now/CVE-2023-46238.md): XSS with User Avatar image in ZITADEL (CVSS 8.7)
- [CVE-2023-44399](https://cve.now/CVE-2023-44399.md): ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting (CVSS 5.3)
- [CVE-2023-22492](https://cve.now/CVE-2023-22492.md): RefreshToken invalidation vulnerability (CVSS 5.9)
- [CVE-2022-36051](https://cve.now/CVE-2022-36051.md): Broken Authorization in ZITADEL Actions (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zitadel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.