3 CVEs
CRITICAL
CVSS 9.3
ZITADEL Identity Platform Login V2 Bypass
2026-03-07
CVE-2026-29191
CRITICAL
PATCH
Stored XSS in ZITADEL identity management platform versions 4.0.0 to 4.11.1 allows unauthenticated attackers to inject persistent scripts through the login flow. Patch available.
9.3
CVSS
0.0%
EPSS
CVE-2026-29193
HIGH
PATCH
ZITADEL is an open source identity management platform. [CVSS 8.2 HIGH]
8.2
CVSS
0.0%
EPSS
CVE-2026-29192
HIGH
PATCH
Account takeover in Zitadel versions 4.0.0 through 4.11.1 is possible through improper redirect URI validation in the login V2 interface, allowing attackers with high privileges to compromise user accounts. This cross-site scripting vulnerability affects organizations using the vulnerable Zitadel identity management platform and has been resolved in version 4.12.0.
7.7
CVSS
0.0%
EPSS