Zitadel vulnerabilities
78 CVEs and advisories name Zitadel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-44671ZITADEL: LDAP Filter Injection in Login Flow
- CVE-2026-33132ZITADEL is missing enforcement of organization scopes
- CVE-2026-32132ZITADEL: Reactivation of Expired Passkey Registration Codes
- CVE-2026-32131ZITADEL Cross-Tenant Information Disclosure in Management API
- CVE-2026-32130ZITADEL SCIM Authentication Bypass via URL Encoding
- CVE-2026-29067ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
- CVE-2026-29193ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2
- CVE-2026-29192ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
- CVE-2026-29191ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2026-27946ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
- CVE-2026-27945ZITADEL has potential SSRF via Actions
- CVE-2026-27840ZITADEL's truncated opaque tokens are still valid
- CVE-2026-23511ZITADEL has a user enumeration vulnerability in Login UIs
- CVE-2025-67717Zitadel Discloses the Total Number of Instance Users
- CVE-2025-67495ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
- CVE-2025-67494ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-64717ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
- CVE-2025-64431IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
- CVE-2025-64103Zitadel Bypass Second Authentication Factor
- CVE-2025-64102Zitadel allows brute-forcing authentication factors
- CVE-2025-64101ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
- CVE-2025-57770ZITADEL user enumeration vulnerability in login UI
- CVE-2025-53895ZITADEL has broken authN and authZ in session API and resulting session tokens
- CVE-2025-48936ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
- CVE-2025-46815ZITADEL Allows IdP Intent Token Reuse
- CVE-2025-31124Zitadel allows User Enumeration by loginname attribute normalization
- CVE-2025-31123Zitadel Expired JWT Keys Usable for Authorization Grants
- CVE-2025-27507IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2024-49757Zitadel User Registration Bypass Vulnerability
- CVE-2024-49753Denied Host Validation Bypass in Zitadel Actions