Skip to content
OpenAdvisories

Package · Go

github.com/zitadel/zitadel

52 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-29191

    ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

    ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in versio…

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Critical 9.3
    CVE-2025-67494 Public exploit

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, …

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Critical 9.0
    CVE-2025-27507

    IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

    The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM rol…

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go