ZI
Vendor
zitadel
74
CVEs
0
On KEV
14
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109374 | ZI zitadel zitadel | 5.5 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation |
| CVE-2026-109373 | ZI zitadel zitadel | 8.1 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie |
| CVE-2026-109372 | ZI zitadel zitadel | 8.7 | Oct 12 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion |
| CVE-2026-109371 | ZI zitadel zitadel | 8.2 | Oct 12 | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 |
| CVE-2026-105215 | ZI zitadel zitadel | 9.1 | Oct 4 | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback |
| CVE-2026-105214 | ZI zitadel zitadel | 2.3 | Oct 4 | Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification |
| CVE-2026-105213 | ZI zitadel zitadel | 8.2 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations |
| CVE-2026-105212 | ZI zitadel zitadel | 7.5 | Oct 4 | ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment |
| CVE-2026-105211 | ZI zitadel zitadel | 8.1 | Oct 4 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode |
| CVE-2026-105210 | ZI zitadel zitadel | 8.2 | Oct 4 | ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers |
| CVE-2026-105209 | ZI zitadel zitadel | 9.6 | Oct 4 | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment |
| CVE-2026-105208 | ZI zitadel zitadel | 7.7 | Oct 4 | ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens |
| CVE-2026-105207 | ZI zitadel zitadel | 9.8 | Oct 4 | ZITADEL before 4.17.3 Account Takeover via External IdP Linking |
| CVE-2026-105206 | ZI zitadel zitadel | 5.3 | Oct 4 | ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service |
| CVE-2026-85056 | ZI zitadel zitadel | 8.2 | Sep 24 | ZITADEL: MFA bypass via session reuse in Login V2 |
| CVE-2026-85057 | ZI zitadel zitadel | 8.7 | Sep 24 | ZITADEL: Actions V1 sandbox escape: host file read via require() |
| CVE-2026-76081 | ZI zitadel zitadel | 5.5 | Sep 14 | ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions |
| CVE-2026-54693 | ZI zitadel zitadel | 8.2 | Jul 29 | ZITADEL Users Can Self-Verify Email/Phone via API |
| CVE-2026-56668 | ZI zitadel zitadel | 8.1 | Jul 10 | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange |
| CVE-2026-56666 | ZI zitadel zitadel | 4.8 | Jul 10 | ZITADEL: Auto-linking by email: IdP-side email verification is not checked |
| CVE-2026-56667 | ZI zitadel zitadel | 7.3 | Jul 10 | ZITADEL: Stored XSS via Default URI Redirect in Login V2 |
| CVE-2026-56665 | ZI zitadel zitadel | 4.2 | Jul 10 | ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider |
| CVE-2026-56664 | ZI zitadel zitadel | 4.2 | Jul 10 | ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider |
| CVE-2026-55672 | ZI zitadel zitadel | 7.4 | Jul 10 | ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) |
| CVE-2026-55671 | ZI zitadel zitadel | 2.3 | Jul 10 | ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components |
| CVE-2026-55670 | ZI zitadel zitadel | 2.3 | Jul 10 | ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers |
| CVE-2026-55669 | ZI zitadel zitadel | 4.2 | Jul 10 | ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider |
| CVE-2026-44671 | ZI zitadel zitadel | 7.5 | May 14 | ZITADEL: LDAP Filter Injection in Login Flow |
| CVE-2026-33132 | ZI zitadel zitadel | 5.3 | Mar 20 | ZITADEL is missing enforcement of organization scopes |
| CVE-2026-32132 | ZI zitadel zitadel | 7.4 | Mar 11 | ZITADEL: Reactivation of Expired Passkey Registration Codes |
| CVE-2026-32131 | ZI zitadel zitadel | 7.7 | Mar 11 | ZITADEL Cross-Tenant Information Disclosure in Management API |
| CVE-2026-32130 | ZI zitadel zitadel | 7.5 | Mar 11 | ZITADEL SCIM Authentication Bypass via URL Encoding |
| CVE-2026-29067 | ZI zitadel zitadel | 9.3 | Mar 7 | ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login |
| CVE-2026-29193 | ZI zitadel zitadel | 8.2 | Mar 7 | ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 |
| CVE-2026-29192 | ZI zitadel zitadel | 7.7 | Mar 7 | ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover |
| CVE-2026-29191 | ZI zitadel zitadel | 9.3 | Mar 7 | ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint |
| CVE-2026-27946 | ZI zitadel zitadel | 6.5 | Feb 26 | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API |
| CVE-2026-27945 | ZI zitadel zitadel | 6.5 | Feb 26 | ZITADEL has potential SSRF via Actions |
| CVE-2026-27840 | ZI zitadel zitadel | 4.3 | Feb 26 | ZITADEL's truncated opaque tokens are still valid |
| CVE-2026-23511 | ZI zitadel zitadel | 5.3 | Jan 15 | ZITADEL has a user enumeration vulnerability in Login UIs |
| CVE-2025-67717 | ZI zitadel zitadel | 4.3 | Dec 11 | Zitadel Discloses the Total Number of Instance Users |
| CVE-2025-67495 | ZI zitadel zitadel | 6.1 | Dec 9 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login |
| CVE-2025-67494 | ZI zitadel zitadel | 8.6 | Dec 9 | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login |
| CVE-2025-64717 | ZI zitadel zitadel | 9.8 | Nov 13 | ZITADEL vulnerable to Account Takeover with deactivated Instance IdP |
| CVE-2025-64103 | ZI Zitadel Zitadel | 9.8 | Oct 29 | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers |
| CVE-2025-64102 | ZI Zitadel Zitadel | 9.8 | Oct 29 | Zitadel is open-source identity infrastructure software |
| CVE-2025-64101 | ZI Zitadel Zitadel | 8.8 | Oct 29 | Zitadel is open-source identity infrastructure software |
| CVE-2025-57770 | ZI Zitadel Zitadel | 5.3 | Aug 22 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration |
| CVE-2025-53895 | ZI Zitadel Zitadel | 8.8 | Jul 15 | ZITADEL is an open source identity management system |
| CVE-2025-48936 | ZI Zitadel Zitadel | 8.8 | May 30 | Zitadel is open-source identity infrastructure software |
| CVE-2025-46815 | ZI Zitadel Zitadel | 8.0 | May 6 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API |
| CVE-2025-31124 | ZI Zitadel Zitadel | 5.3 | Mar 31 | Zitadel is open-source identity infrastructure software |
| CVE-2025-31123 | ZI Zitadel Zitadel | 8.7 | Mar 31 | Zitadel is open-source identity infrastructure software |
| CVE-2025-27507 | ZI Zitadel Zitadel | 9.0 | Mar 4 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration |
| CVE-2024-49757 | ZI Zitadel Zitadel | 4.9 | Oct 25 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration |
| CVE-2024-49753 | ZI Zitadel Zitadel | 9.1 | Oct 25 | Zitadel is open-source identity infrastructure software |
| CVE-2024-47060 | ZI Zitadel Zitadel | 6.5 | Sep 20 | Zitadel is an open source identity management platform |
| CVE-2024-47000 | ZI Zitadel Zitadel | 7.5 | Sep 20 | Zitadel is an open source identity management platform |
| CVE-2024-46999 | ZI Zitadel Zitadel | 6.5 | Sep 20 | Zitadel is an open source identity management platform |
| CVE-2024-41953 | ZI Zitadel Zitadel | 6.1 | Jul 31 | Zitadel is an open source identity management system |