Skip to content
OpenAdvisories

Vendor

zitadel

78 known vulnerabilities.

Products

zitadel 78
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-109372 Public exploit

    ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

    ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent wi…

    zitadel zitadel
  • Critical 9.3
    CVE-2025-67494 Public exploit

    ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

    ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, …

    zitadel zitadel github.com/zitadel/zitadel github.com/zitadel/zitadel/v2 Go
  • Medium 6.5
    CVE-2024-32868 Public exploit

    ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

    ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…

    zitadel zitadel github.com/zitadel/zitadel Go