Login Request a demo
ZI
Product
zitadel
by zitadel · last CVE Oct 12, 2026
75
CVEs
0
On KEV
9.8
Max CVSS
14
New 30D
Vulnerabilities75In the news0Timeline
Severity mix
Critical 10High 33Medium 28Low 4
Severity
All severities75Critical10High33Medium28Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add zitadel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105207
9.8
0%
Oct 4
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
Affected: before 4.17.3; through 4.19.4
CVE-2025-64717
9.8
0%
Nov 13
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
Affected: >= 4.0.0-rc.1, < 4.6.6; >= 3.0.0-rc.1, < 3.4.4; >= 2.50.0, < 2.71.19
CVE-2025-64103
9.8
0%
Oct 29
Zitadel Bypass Second Authentication Factor
Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.55.0, < 2.71.18; >= 2.54.3, <= 2.54.10; >= 2.53.6, <= 2.53.9
CVE-2025-64102
9.8
0%
Oct 29
Zitadel allows brute-forcing authentication factors
Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18
CVE-2026-105209
9.6
0%
Oct 4
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
Affected: before 4.17.1; before 3.4.15
CVE-2026-29067
9.3
0%
Mar 7
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
Affected: >= 4.0.0-rc.1, < 4.7.1
CVE-2026-29191
9.3
0%
Mar 7
ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
Affected: >= 4.0.0, < 4.12.0
CVE-2026-105215
9.1
0%
Oct 4
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
Affected: before 4.16.2; before 3.4.14
CVE-2024-49753
9.1
1%
Oct 25
Zitadel is open-source identity infrastructure software
Affected: before 2.58.7; 2.59.0 before 2.59.5; 2.60.0 before 2.60.4; 2.61.0 before 2.61.4; 2.62.0 before 2.62.8; 2.63.0 before 2.63.6; +1 more
CVE-2025-27507
9.0
1%
Mar 4
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration
Affected: before 2.63.8; 2.64.0 before 2.64.5; 2.65.0 before 2.65.6; 2.66.0 before 2.66.11; 2.67.0 before 2.67.8; 2.68.0 before 2.68.4; +2 more
Showing 10