Zitadel
CVE-2026-29191
CRITICAL
GHSA-pr34-2v5x-6qjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SAML response with XSS payload
-
DeliverySend to /saml-post endpoint
-
ExploitVictim clicks link triggering XSS
-
ExecutionSteal session token
-
ImpactHijack user account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | ZITADEL version 4.0.0 through 4.11.1 with login V2 interface enabled. SAML authentication must be configured and active. Victim must click attacker-controlled link to /saml-post endpoint containing crafted SAML response with XSS payload. |
| Impact | CVSS 9.3. XSS in an identity provider is extremely dangerous — it can intercept credentials, session tokens, and MFA codes. |
| Exploit ScenarioDerived | Attacker injects JavaScript into ZITADEL login page, steals credentials and session tokens from all users who access the login flow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Stored XSS in ZITADEL identity management platform versions 4.0.0 to 4.11.1 allows unauthenticated attackers to inject persistent scripts through the login flow. Patch available.
Earlier versions of this analysis (1)
Stored XSS in ZITADEL login flow.
RemediationAI
Update to ZITADEL 4.11.2 or later. Implement CSP headers.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 stored XSS in the login interface of an identity management platform. Unauthenticated injection that persists and executes for all users.
Know when Zitadel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.
Executive ViewAI
A critical vulnerability in ZITADEL's login interface (versions 4.0.0-4.11.1) enables attackers to compromise user accounts through cross-site scripting (XSS) attacks. Organizations using affected versions face immediate risk of unauthorized account access and potential compromise of identities managed through the platform, affecting all downstream applications relying on ZITADEL for authentication.
Apply vendor patch. If patch deployment is delayed: (1) Implement WAF rules to block malicious payloads targeting the /saml-post endpoint; (2) Restrict SAML endpoint access to known IP ranges; (3) Enable enhanced logging and monitoring on authentication endpoints; (4) Consider temporarily disabling SAML-based login if risk tolerance is extremely low pending patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in ZITADEL Identity Platform Login V2 Bypass
View all 3Zitadel is open-source identity infrastructure software. Rated critical severity (CVSS 9.1), this vulnerability is remot
ZITADEL is an identity infrastructure system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Authentication bypass in ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 lets an authenticated attacker with organizati
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated r
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim'
Authentication bypass in ZITADEL's Login V2 UI (versions 3.0.0 through 4.19.1) allows unauthenticated attackers to take
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected a
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Ra
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Ra
Unauthenticated username-change in ZITADEL's hosted Login V1 UI lets a remote attacker rename any active human account -
ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users
Exploit-DB