What is the CVSS score of CVE-2026-56667?

CVE-2026-56667 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of ZITADEL are affected by CVE-2026-56667?

ZITADEL's self-hosted Login V2 (prior to version 4.15.3) contains a stored XSS vulnerability in login redirect configuration that allows privileged administrators to inject malicious scripts executed…. A patch is available.

How to fix or mitigate CVE-2026-56667?

24 hours: Audit administrative accounts with loginSettings configuration privileges and review all stored defaultRedirectUri values for javascript: or data: URI schemes; remediate any suspicious entries. 7 days: Upgrade all affected ZITADEL Login V2 instances to version 4.15.3 or later. 30 days: Conduct security testing of all authentication flows post-upgrade and implement code review controls for future redirect URI configuration changes.

ZITADEL CVE-2026-56667

EUVD-2026-42964 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 GitHub_M

XSS Zitadel

7.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.3 HIGH

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.3 HIGH

Requires admin write access to redirect settings (PR:H) and a victim reaching a specific error path (UI:R, AC:H); stored XSS crosses into the user's browser (S:C) with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:23 vuln.today

DescriptionCVE.org

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached. This issue is fixed in version 4.15.3.

AnalysisAI

Stored cross-site scripting in ZITADEL's Login V2 (versions prior to 4.15.3) lets an organization or instance administrator plant a javascript: or data: URI in the loginSettings.defaultRedirectUri, which is passed to router.push on OIDC and SAML FailedPrecondition error paths without the isSafeRedirectUri validation, executing arbitrary script in a victim user's browser. Because the malicious value must be set by a privileged admin and only fires when a user hits a specific login error path, this is a privilege-escalation/session-compromise vector against the self-hosted identity platform rather than a mass-exploitable flaw. No public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

ZITADEL is an open-source cloud-native identity and access management platform (Auth0/Keycloak alternative) providing OIDC and SAML authentication. The root cause is CWE-79 (improper neutralization of input during web page generation): the redirect handling for the newer Login V2 UI normally routes untrusted redirect targets through an isSafeRedirectUri allowlist check that rejects dangerous schemes like javascript: and data:. On the OIDC and SAML FailedPrecondition error branches this sanitization was omitted, so the configured defaultRedirectUri was handed directly to the frontend router.push() navigation. A stored javascript:/data: URI therefore executes in the browser context of any user who reaches that error path. Affected component per CPE is cpe:2.3:a:zitadel:zitadel across all versions below the 4.15.3 fix.

RemediationAI

Vendor-released patch: upgrade to ZITADEL 4.15.3, which restores the isSafeRedirectUri check on the OIDC and SAML FailedPrecondition error paths (fix commit 038265925a3b05ac1df8aad461ab071983e9eb85, release https://github.com/zitadel/zitadel/releases/tag/v4.15.3, advisory https://github.com/zitadel/zitadel/security/advisories/GHSA-5wcj-9wj4-j65h). If immediate upgrade is not possible, treat the ability to set loginSettings.defaultRedirectUri as sensitive: audit and constrain which org and instance administrators can modify login/redirect settings, review existing defaultRedirectUri values for javascript: or data: schemes and reset any non-https(s) values, and tighten administrative access reviews - the trade-off is added operational overhead and no protection against an already-malicious legitimate admin, so upgrading remains the only complete remedy.