ZI
Product
zitadel
75
CVEs
0
On KEV
9.8
Max CVSS
14
New 30D
Severity mix
Critical 10High 33Medium 28Low 4
Watch
Add zitadel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-64101 | 8.8 | Oct 29 | ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection Affected: >= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18 |
| CVE-2025-53895 | 8.8 | Jul 15 | ZITADEL has broken authN and authZ in session API and resulting session tokens Affected: = 4.0.0-rc.1; >= 3.0.0, < 3.3.1; >= 2.53.0, < 2.70.14; >= 2.71.0, < 2.71.13 |
| CVE-2025-48936 | 8.8 | May 30 | Zitadel is open-source identity infrastructure software Affected: 2.0.0 before 2.70.12; 2.71.0 before 2.71.11; 3.0.0 before 3.2.2 |
| CVE-2023-49097 | 8.8 | Nov 30 | ZITADEL is an identity infrastructure system Affected: 2.39.0 before 2.39.9; 2.40.0 before 2.40.10; 2.41.0 before 2.41.6 |
| CVE-2022-36051 | 8.8 | Aug 31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users… Affected: 1.42.0 before 1.87.1; 2.0.0 before 2.2.0 |
| CVE-2026-109372 | 8.7 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion Affected: 3.0.0 before 4.19.2 |
| CVE-2026-85057 | 8.7 | Sep 24 | ZITADEL: Actions V1 sandbox escape: host file read via require() Affected: >= 3.0.0, < 3.4.13; >= 4.0.0, < 4.16.1 |
| CVE-2025-64431 | 8.7 | Nov 7 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering Affected: >= 4.0.0-rc.1, < 4.6.3; >= 1.80.0-v2.20.0.20250414095945-f365cee73242, < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 |
| CVE-2025-31123 | 8.7 | Mar 31 | Zitadel is open-source identity infrastructure software Affected: 2.62.0 before 2.63.9; 2.64.0 before 2.64.6; 2.65.0 before 2.65.7; 2.66.0 before 2.66.16; 2.67.0 before 2.67.13; 2.68.0 before 2.68.9; +3 more |
| CVE-2024-29891 | 8.7 | Mar 27 | ZITADEL users can upload their own avatar image and various image types are allowed Affected: before 2.42.17; 2.43.0 before 2.43.11; 2.44.0 before 2.44.7; 2.45.0 before 2.45.5; 2.46.0 before 2.46.5; 2.47.0 before 2.47.8; +1 more |
| CVE-2025-67494 | 8.6 | Dec 9 | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login Affected: < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 |
| CVE-2026-109371 | 8.2 | Oct 12 | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 Affected: 3.0.0 before 4.18.0 |
| CVE-2026-105213 | 8.2 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations Affected: before 4.17.1 |
| CVE-2026-105210 | 8.2 | Oct 4 | ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers Affected: before 4.17.1; before 3.4.15 |
| CVE-2026-85056 | 8.2 | Sep 24 | ZITADEL: MFA bypass via session reuse in Login V2 Affected: >= 4.0.0, < 4.16.1 |
| CVE-2026-54693 | 8.2 | Jul 29 | ZITADEL Users Can Self-Verify Email/Phone via API Affected: >= 2.43.0, <= 2.71.19; >= 3.0.0-rc.1, < 3.4.11; >= 4.0.0-rc.1, < 4.15.1 |
| CVE-2026-29193 | 8.2 | Mar 7 | ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 Affected: >= 4.0.0, < 4.12.1 |
| CVE-2026-109373 | 8.1 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie Affected: 3.0.0 before 4.19.2 |
| CVE-2026-105211 | 8.1 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode Affected: before 4.17.1 |
| CVE-2026-56668 | 8.1 | Jul 10 | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange Affected: < 4.15.3 |
| CVE-2024-32868 | 8.1 | Apr 26 | ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email Affected: before 2.50.0 |
| CVE-2025-46815 | 8.0 | May 6 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API Affected: before 2.70.10; 2.71.0 before 2.71.9; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2026-105208 | 7.7 | Oct 4 | ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens Affected: before 4.17.3; through 4.19.4 |
| CVE-2026-32131 | 7.7 | Mar 11 | ZITADEL Cross-Tenant Information Disclosure in Management API Affected: >= 4.0.0, < 4.12.2; < 3.4.8 |
| CVE-2026-29192 | 7.7 | Mar 7 | ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover Affected: >= 4.0.0, < 4.12.0 |
| CVE-2026-105212 | 7.5 | Oct 4 | ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment Affected: before 4.16.2; before 3.4.14 |
| CVE-2026-44671 | 7.5 | May 14 | ZITADEL: LDAP Filter Injection in Login Flow Affected: >= 2.71.11, < 3.4.10; >= 4.0.0, < 4.15.0 |
| CVE-2026-32130 | 7.5 | Mar 11 | ZITADEL SCIM Authentication Bypass via URL Encoding Affected: >= 4.0.0, < 4.12.2; >= 2.68.0, < 3.4.8 |
| CVE-2024-47000 | 7.5 | Sep 20 | Zitadel is an open source identity management platform Affected: before 2.54.10; 2.55.0 before 2.55.8; 2.56.0 before 2.56.6; 2.57.0 before 2.57.5; 2.58.0 before 2.58.5; 2.59.0 before 2.59.3; +3 more |
| CVE-2024-28197 | 7.5 | Mar 11 | Zitadel is an open source identity management system Affected: before 2.44.3; 2.45.0; 2.45.0; 2.46.0; 2.46.0 |
| CVE-2026-55672 | 7.4 | Jul 10 | ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) Affected: >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 |
| CVE-2026-32132 | 7.4 | Mar 11 | ZITADEL: Reactivation of Expired Passkey Registration Codes Affected: >= 4.0.0, < 4.12.2; < 3.4.8 |
| CVE-2026-56667 | 7.3 | Jul 10 | ZITADEL: Stored XSS via Default URI Redirect in Login V2 Affected: < 4.15.3 |
Showing 33