Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

zitadel — Vulnerabilities & Security Advisories 78

All 78 CVE vulnerabilities found in zitadel, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting the identity and access management platform Zitadel, categorized by specific weakness types and relevant security tags. The collection encompasses a comprehensive range of disclosed issues, including authentication bypasses, privilege escalation flaws, and cryptographic misconfigurations, covering the entire historical timeline from the product's initial release to the present day. Visitors can utilize this resource to track official vendor advisories for timely remediation, analyze the prevalence and impact of specific weakness classes within the identity management sector, or review the complete vulnerability history of the Zitadel product to assess its security posture over time. The data presented here is derived from public advisories and verified reports, offering a neutral and factual overview of the security landscape surrounding this software. By consolidating these details, the page serves as a centralized reference for security professionals, developers, and system administrators seeking to understand potential risks and implement appropriate defensive measures. No specific CVE identifiers are listed in this summary, ensuring the focus remains on the broader patterns of vulnerability and the strategic value of the aggregated information for ongoing security maintenance and risk management efforts.

Vendor: zitadel

CVE ID Title CVSS Severity Published
CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval CWE-862 8.1 High 2026-10-29
CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie CWE-565 7.4 High 2026-10-29
CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection CWE-640 8.1 High 2026-10-29
CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation CWE-863 5.5 Medium 2026-10-12
CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie CWE-441 8.1 High 2026-10-12
CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion CWE-287 8.7 High 2026-10-12
CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 CWE-306 8.2 High 2026-10-12
CVE-2026-105215 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback CWE-290 9.1 Critical 2026-10-04
CVE-2026-105214 Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification CWE-918 2.3 Low 2026-10-04
CVE-2026-105213 ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations CWE-287 8.2 High 2026-10-04
CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode CWE-200 8.1 High 2026-10-04
CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment CWE-287 7.5 High 2026-10-04
CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers CWE-287 8.2 High 2026-10-04
CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment CWE-862 9.6 Critical 2026-10-04
CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens CWE-649 7.7 High 2026-10-04
CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking CWE-306 9.8 Critical 2026-10-04
CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service CWE-863 5.3 Medium 2026-10-04
CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2 CWE-287 8.2 High 2026-09-24
CVE-2026-85057 ZITADEL: Actions V1 sandbox escape: host file read via require() CWE-284 8.7 High 2026-09-24
CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions CWE-193 5.5 Medium 2026-09-14
CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API CWE-863 8.2 High 2026-07-29
CVE-2026-56668 ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange CWE-862 8.1 High 2026-07-10
CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked CWE-287 4.8 Medium 2026-07-10
CVE-2026-56667 ZITADEL: Stored XSS via Default URI Redirect in Login V2 CWE-79 7.3 High 2026-07-10
CVE-2026-56665 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider CWE-613 4.2 Medium 2026-07-10
CVE-2026-56664 ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider CWE-613 4.2 Medium 2026-07-10
CVE-2026-55672 ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) CWE-287 7.4 High 2026-07-10
CVE-2026-55671 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components CWE-918 - - 2026-07-10
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers CWE-284 - - 2026-07-10
CVE-2026-55669 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider CWE-346 4.2 Medium 2026-07-10

All 78 known CVE vulnerabilities affecting zitadel with full Chinese analysis, references, and POCs where available.