zitadel vulnerabilities | LiveThreat CVE Feed

Product

zitadel

by zitadel · last CVE Oct 12, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities75 In the news0 Timeline

Severity mix

Critical 10High 33Medium 28Low 4

Severity

All severities75 Critical10 High33 Medium28 Low4

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add zitadel to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-28855	6.1	1%	Mar 18	ZITADEL, open source authentication management software, uses Go templates to render the login UI Affected: before 2.41.15; 2.42.0 before 2.42.15; 2.43.0 before 2.43.9; 2.44.0 before 2.44.3; 2.47.0 before 2.47.4; 2.45.0; +4 more
CVE-2023-22492	5.9	1%	Jan 11	ZITADEL is a combination of Auth0 and Keycloak Affected: 2.0.0 before 2.16.4; 2.17.0 before 2.17.3
CVE-2026-109374	5.5	0%	Oct 12	ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation Affected: 3.0.0 before 4.19.2
CVE-2026-76081	5.5	0%	Sep 14	ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions Affected: < 4.16.0
CVE-2023-46238	5.4	1%	Oct 26	ZITADEL is an identity infrastructure management system Affected: before 2.38.2; 2.39.0 before 2.39.2
CVE-2026-105206	5.3	0%	Oct 4	ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service Affected: before 4.17.3; through 4.19.4
CVE-2026-33132	5.3	0%	Mar 20	ZITADEL is missing enforcement of organization scopes Affected: >= 4.0.0-rc.1, < 4.12.3; >= 3.0.0-rc.1, < 3.4.9; < 1.80.0-v2.20.0.20260317120401-d90285929ca0
CVE-2026-23511	5.3	0%	Jan 15	ZITADEL has a user enumeration vulnerability in Login UIs Affected: >= 4.0.0, < 4.9.1; < 3.4.6
CVE-2025-57770	5.3	0%	Aug 22	ZITADEL user enumeration vulnerability in login UI Affected: < 2.71.15; >= 3.0.0, < 3.4.0; >= 4.0.0, < 4.0.3
CVE-2025-31124	5.3	1%	Mar 31	Zitadel is open-source identity infrastructure software Affected: before 2.63.9; 2.64.0 before 2.64.6; 2.65.0 before 2.65.7; 2.66.0 before 2.66.16; 2.67.0 before 2.67.13; 2.68.0 before 2.68.9; +3 more
CVE-2024-41952	5.3	1%	Jul 31	Zitadel is an open source identity management system Affected: 2.53.0 before 2.53.9; 2.54.0 before 2.54.8; 2.55.0 before 2.55.5; 2.56.0 before 2.56.2; 2.57.0; 2.57.0; +2 more
CVE-2024-32967	5.3	1%	May 1	Zitadel is an open source identity management system Affected: before 2.45.7; 2.46.0 before 2.46.7; 2.47.0 before 2.47.10; 2.48.0 before 2.48.5; 2.49.0 before 2.49.5; 2.50.0 before 2.50.3
CVE-2023-44399	5.3	1%	Oct 10	ZITADEL provides identity infrastructure Affected: through 2.37.2
CVE-2024-49757	4.9	3%	Oct 25	The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration Affected: before 2.58.7; 2.59.0 before 2.59.5; 2.60.0 before 2.60.4; 2.61.0 before 2.61.4; 2.62.0 before 2.62.7; 2.63.0 before 2.63.5
CVE-2024-29892	4.9	1%	Mar 27	ZITADEL, open source authentication management software, uses Go templates to render the login UI Affected: before 2.42.17; 2.43.0 before 2.43.11; 2.44.0 before 2.44.7; 2.45.0 before 2.45.5; 2.46.0 before 2.46.5; 2.47.0 before 2.47.8; +1 more
CVE-2026-56666	4.8	0%	Jul 10	ZITADEL: Auto-linking by email: IdP-side email verification is not checked Affected: < 4.15.3
CVE-2026-27840	4.3	0%	Feb 26	ZITADEL's truncated opaque tokens are still valid Affected: >= 4.0.0, < 4.11.0; >= 3.0.0, < 3.4.7; >= 2.31.0, <= 2.71.19
CVE-2025-67717	4.3	0%	Dec 11	Zitadel Discloses the Total Number of Instance Users Affected: < 1.80.0-v2.20.0.20251210; >= 2.44.0, < 3.4.5; >= 4.0.0-rc.1, < 4.7.2
CVE-2026-56665	4.2	0%	Jul 10	ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2026-56664	4.2	0%	Jul 10	ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2026-55669	4.2	0%	Jul 10	ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12
CVE-2023-47111	3.7	1%	Nov 8	ZITADEL provides identity infrastructure Affected: before 2.38.3; 2.39.0 before 2.40.5
CVE-2026-105214	2.3	0%	Oct 4	Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification Affected: before 4.16.2
CVE-2026-55671	2.3	0%	Jul 10	ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components Affected: < 4.15.2
CVE-2026-55670	2.3	0%	Jul 10	ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers Affected: < 4.15.2