Skip to content
OpenAdvisories

Vendor

zitadel

78 known vulnerabilities.

Products

zitadel 78
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-105215

    ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

    ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenti…

    zitadel zitadel
  • Critical 9.6
    CVE-2026-105209

    ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

    ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attacke…

    zitadel zitadel
  • Critical 9.8
    CVE-2026-105207

    ZITADEL before 4.17.3 Account Takeover via External IdP Linking

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 Ad…

    zitadel zitadel
  • Critical 9.3
    CVE-2026-29191

    ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

    ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in versio…

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Critical 9.3
    CVE-2025-67494 Public exploit

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, …

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Critical 9.0
    CVE-2025-27507

    IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

    The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM rol…

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go