Zitadel vulnerabilities
78 CVEs and advisories name Zitadel as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-46999User Grant Deactivation not Working in Zitadel
- CVE-2024-47000Service Users Deactivation not Working in Zitadel
- CVE-2024-47060Unauthorized Access After Organization or Project Deactivation in Zitadel
- CVE-2024-41953Zitadel improperly sanitizes HTML in emails and Console UI
- CVE-2024-41952Zitadel has an "Ignoring unknown usernames" vulnerability
- CVE-2024-39683ZITADEL Vulnerable to Session Information Leakage
- CVE-2024-32967Zitadel exposes internal database user name and host information
- CVE-2024-32868ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
- CVE-2024-29892ZITADEL's actions can overload reserved claims
- CVE-2024-29891ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
- CVE-2024-28855ZITADEL vulnerable to improper HTML sanitization
- CVE-2024-28197Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
- CVE-2023-49097ZITADEL vulnerable account takeover via malicious host header injection
- CVE-2023-47111ZITADEL race condition in lockout policy execution
- CVE-2023-46238XSS with User Avatar image in ZITADEL
- CVE-2023-44399ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
- CVE-2023-22492RefreshToken invalidation vulnerability
- CVE-2022-36051Broken Authorization in ZITADEL Actions