Zitadel
Monthly
Authentication bypass in ZITADEL's Login V2 UI (versions 3.0.0 through 4.19.1) allows unauthenticated attackers to take over user accounts, including administrators with MFA completed, by forging unsigned session cookies and guessing time-ordered session IDs around a victim's sign-in to trigger token rotation. Exploitation requires the target to run the affected Login V2 UI and the attacker to hit a narrow timing window; no public exploit code is identified at time of analysis. While the CVE carries a CVSS 4.0 score of 9.2, the independent assessment rates it with high attack complexity (CVSS 3.1 AV:N/AC:H/PR:N/UI:N), reflecting the timing prerequisite.
Authentication bypass in ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 lets an authenticated attacker with organization-administrator permission register a SAML identity provider using their own signing key and then obtain authenticated sessions as any user linked to a different SAML provider on the same instance, including users in other organizations. The flaw stems from the SAML identity-provider intent callback verifying the assertion signature against the provider named in the request URL while resolving the user from the login intent without confirming the two match. This is a genuine high-priority vulnerability, though not a 'spray-and-pray' internet-wide threat; exploitation requires the org-admin prerequisite and that victims authenticate via SAML identity providers. No public exploit identified at time of analysis, and a vendor-released patch exists (4.19.2 and later for 4.x; a fix beyond 3.4.15 for 3.x).
Unauthenticated username-change in ZITADEL's hosted Login V1 UI lets a remote attacker rename any active human account - including administrators - by supplying only the victim's login name, locking legitimate users out of the identity provider. The underlying defect is CWE-306 (missing authentication for a critical function): the change-username handler acts on the account bound to the login flow before any authentication factor is verified, so deployments running ZITADEL 3.0.0 through 4.17.x with Login V1 enabled are exposed, while instances on a newer login flow or already upgraded to 4.18.0+ are not. No public exploit identified at time of analysis and no CISA KEV listing applies; the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L describes a high-integrity, low-availability impact bounded to the Login V1 population, consistent with the VulnCheck-reported CVSS 4.0 score of 8.8.
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim's external identity provider subject, so that the victim's later, legitimate external login is transparently signed into the attacker-controlled account. Affected deployments are ZITADEL before 3.4.14 and 4.x before 4.16.2 that still run the legacy hosted Login V1 UI with at least one external IdP configured; exploitation also requires the attacker to know a valid IDPConfigID and the victim's ExternalUserID, which tempers the 9.3 CVSS 4.0 rating (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the lack of authentication, low attack complexity, and full account-takeover outcome make this a high-priority patch target.
ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users of a deactivated organization to continue signing in, create sessions, and obtain or refresh tokens if they already possess valid credentials, an existing session, or a refresh token. This authenticated access-control bypass primarily impacts offboarding and deprovisioning workflows, as it does not allow an arbitrary external attacker to gain access without prior valid credentials. No public exploit has been identified at time of analysis, and the flaw does not affect active organizations or bypass per-user deactivation.
Account takeover in ZITADEL affects deployments using the hosted Login V1 or V2 UI on versions 3.x before 3.4.14 and 4.x before 4.16.2. Unauthenticated attackers who know a valid login name can enroll an attacker-controlled passkey or other authenticator during an identify-only session, before any primary factor is verified, and then log in as the victim, bypassing passwords and MFA. No public exploit code has been identified at time of analysis, but the vulnerability is rated high risk due to its unauthenticated nature and low complexity.
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected accounts, including administrator accounts, by reading OTP codes from server-action responses when the 'returnCode' OTP delivery type is enabled and the victim has both OTP-Email and OTP-SMS enrolled. The attack requires prior knowledge of the victim's login name and a non-default deployment configuration; instances using standard out-of-band OTP delivery or users without both factors are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but the complete compromise of confidentiality, integrity, and availability of targeted identities warrants immediate patching.
Unauthenticated remote attackers who know a valid user's login name can enroll attacker-controlled multi-factor authentication factors - including TOTP, OTP-SMS, OTP-Email, and U2F - and overwrite the victim's verified phone number in ZITADEL deployments that expose the legacy hosted Login V1 UI. Affected versions are 3.x before 3.4.15 and 4.x before 4.17.1. The flaw resides in second-factor enrollment and initialization handlers that act on an identify-only session before any primary factor is verified, and it also lets attackers enumerate valid usernames through discrepant error responses. No public exploit code has been identified at time of analysis, but this is a genuine high-priority risk given the low prerequisite (only a login name) and high integrity impact (CVSS 8.8; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:N).
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker who holds user-write permission in one organization to request a passkey or passwordless enrollment code for a user in a different organization on the same multi-tenant instance, then register their own authenticator and seize that account. The flaw is an improper authorization check (CWE-862): the server validates the organization named in the x-zitadel-orgid header instead of the target user's actual organization. Exploitation requires a deployment hosting at least two organizations plus a valid low-privileged user-write role, so single-organization instances and instances already on 3.4.15 or 4.17.1+ are not affected; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Session hijacking and theft of external IdP tokens in ZITADEL 4.x before 4.17.3 and ZITADEL 3.x through 3.4.15 stem from IdP intent tokens that are encrypted without integrity protection, so an authenticated user (CVSS PR:L) can tamper with a token issued for their own login intent and have it accepted for another user's intent. An attacker who correctly predicts a victim's in-flight intent identifier and wins a timing race while the victim is completing an external IdP login can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or take over the resulting session. The impact is genuine but conditional rather than a mass-exploitable issue: it requires a valid authenticated account, an actively logging-in victim, correct identifier prediction, and a narrow race window (AC:H and AT:P in the assessed vector), and no public exploit identified at time of analysis; upgrading to 4.17.3 (or the corresponding fixed 3.x release) removes the condition.
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated remote attacker who knows a victim's login name can bind an external identity provider (IdP) identity they control to the victim's account and then sign in as that user, obtaining full control of the account and its data. The root cause is that the account-to-IdP linking flow neither verifies a primary authentication factor nor checks the caller's permission, and it is reachable through two distinct paths named in the advisory - identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. The vendor has published a fix for the 4.x line in 4.17.3, no public exploit code was identified at time of analysis, and this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact because exploitation requires only knowledge of the victim's login name and network reachability.
MFA bypass in ZITADEL Login V2 (versions 4.0.0 through 4.16.0) lets an attacker who already holds a victim's valid first-factor password complete an OIDC or SAML login to a customer application without ever satisfying the user's voluntarily enrolled TOTP, OTP, or U2F second factor. The browser session created after password verification is reused when the login flow is abandoned at the MFA step and restarted, and the pre-fix session-validity check only demanded MFA when the organization had Force MFA or Force MFA for local users enabled. The assessed CVSS 3.1 vector is 8.2 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflecting the requirement of the victim's password; Login V1, the ZITADEL Console, Management/Admin APIs, and user self-management are unaffected, a vendor patch is available as 4.16.1, and no public exploit code has been identified at time of analysis.
ZITADEL Actions V1 on affected releases (3.0.0 through pre-3.4.13 and the 4.x line before 4.16.1) fails to restrict the goja Node-compatible require() registry, so an authenticated organization Action author holding ORG_OWNER, org.action.write, and org.flow.write can execute JavaScript at OIDC, SAML, or login-flow triggers and load arbitrary files readable by the ZITADEL server process. This exposes mounted configuration and secrets - notably credentials referenced by ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH and ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH - and recovered bootstrap credentials can let an organization administrator escalate to instance administrator; host command execution is not established. CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a high-privilege prerequisite; no public exploit code has been identified at time of analysis, and the issue is patched in 3.4.13 and 4.16.1.
Privilege escalation in ZITADEL identity platform (before 4.15.3) allows an attacker holding a low-privilege OAuth2 token to exchange it for elevated permissions at a different application, because the token-exchange endpoint fails to bind the subject token to the requesting client and does not constrain requested scopes to the original token's scopes. Any authenticated principal with a valid low-scope token can escalate laterally across relying applications; no public exploit is identified at time of analysis and it is not listed in CISA KEV. A vendor patch (4.15.3) and fixing commit are available.
Stored cross-site scripting in ZITADEL's Login V2 (versions prior to 4.15.3) lets an organization or instance administrator plant a javascript: or data: URI in the loginSettings.defaultRedirectUri, which is passed to router.push on OIDC and SAML FailedPrecondition error paths without the isSafeRedirectUri validation, executing arbitrary script in a victim user's browser. Because the malicious value must be set by a privileged admin and only fires when a user hits a specific login error path, this is a privilege-escalation/session-compromise vector against the self-hosted identity platform rather than a mass-exploitable flaw. No public exploit identified at time of analysis; not listed in CISA KEV.
ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by insufficient session expiration (CVSS 7.4).
ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by authorization bypass through user-controlled key (CVSS 7.7).
ZITADEL is an open source identity management platform. From 2.68.0 to versions up to 3.4.8 contains a security vulnerability (CVSS 7.5).
ZITADEL is an open source identity management platform. [CVSS 8.2 HIGH]
Account takeover in Zitadel versions 4.0.0 through 4.11.1 is possible through improper redirect URI validation in the login V2 interface, allowing attackers with high privileges to compromise user accounts. This cross-site scripting vulnerability affects organizations using the vulnerable Zitadel identity management platform and has been resolved in version 4.12.0.
Stored XSS in ZITADEL identity management platform versions 4.0.0 to 4.11.1 allows unauthenticated attackers to inject persistent scripts through the login flow. Patch available.
ZITADEL versions 4.0.0-rc.1 through 4.7.0 are vulnerable to open redirect attacks through improper validation of the Forwarded and X-Forwarded-Host headers used in password reset links. An attacker can craft a malicious request to redirect users to an attacker-controlled domain when they click password reset confirmation links, enabling credential harvesting or phishing attacks. The vulnerability affects all deployments using affected versions and has been patched in version 4.7.1.
Privilege escalation in ZITADEL 3.0.0 through 4.19.1 lets accounts that already hold the IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role obtain tokens for administrators, including IAM_OWNER, and sign in to relying applications carrying those administrators' roles and claims, because the OIDC token-exchange flow fails to enforce the admin.impersonation check (CWE-863). Exploitation requires the high-privilege prerequisite that an end-user impersonator role has been deliberately granted (CVSS PR:H), so arbitrary authenticated users and unauthenticated attackers cannot trigger it, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor fixed the bypass in ZITADEL 4.19.2.
Zitadel deployments before 4.16.2 expose a server-side request forgery (SSRF) path in the organization custom-domain HTTP verification flow, where the challenge fetch uses Go's default http.Get rather than Zitadel's SSRF-protected HTTP client. An authenticated principal holding privileges to create or manage an organization and register a custom domain can point DNS/HTTP for that domain at loopback, RFC1918/internal, or link-local cloud metadata addresses (e.g., 169.254.169.254), causing the Zitadel server to issue requests to those targets and enabling port scanning and internal network mapping. Impact is limited to server-side reconnaissance - there is no data modification, and confidentiality exposure depends on what internal or metadata services are actually reachable from the instance - and no public exploit code has been identified at time of analysis; EPSS and KEV signals are absent, and the scored severity is low (CVSS v4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Cross-organization information disclosure in ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 allows an authenticated user who holds an organization-scoped user.read permission to retrieve the authentication method types registered by users in other organizations by calling GET /v2/users/{userId}/authentication_methods. The User Service API validates user.read against the caller's own organization rather than the organization that owns the target user (CWE-863 incorrect authorization), so tenant isolation is broken on multi-organization deployments. Exploitation requires a valid account with org-scoped user.read (PR:L per the assessed vector) and knowledge or enumeration of foreign-org user IDs; impact is limited to method-type disclosure with no credential, token, or account modification exposure, and no public exploit code was identified at time of analysis. CVSS 4.0 base 5.3 and our independent assessment of 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree that this is a medium-severity confidentiality issue.
Account takeover in ZITADEL's external identity provider auto-linking logic prior to version 4.15.3 allows an unauthenticated network attacker to hijack a victim's local ZITADEL account. The handler confirms that the local user's email is verified but fails to require the external IdP to also confirm ownership of that same email address before completing the link - meaning an attacker who registers a victim's email on a permissive external IdP (one that does not enforce email verification) can silently gain full access to the victim's ZITADEL account. No public exploit has been identified at time of analysis; the fix is available in the vendor-released patch v4.15.3.
Insufficient JWT expiration enforcement in ZITADEL's external JWT Identity Provider integration allows tokens lacking the `exp` claim to be treated as indefinitely valid, bypassing intended session lifetime controls. Versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1 are affected, with the flaw residing in `internal/idp/providers/jwt/session.go`. An attacker who can obtain or craft a JWT from a configured trusted external issuer that omits the `exp` claim can maintain persistent authenticated access without re-authentication. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insufficient session expiration in ZITADEL's external JWT Identity Provider allows arbitrarily old tokens from trusted issuers to pass authentication when the token omits the iat (issued-at) claim. ZITADEL versions prior to 3.4.12 (v3 branch) and 4.15.2 (v4 branch) are affected. An attacker holding a previously issued JWT from a trusted external IdP - specifically one lacking the iat claim - can reuse that token indefinitely, bypassing intended session expiry controls and maintaining unauthorized access. No public exploit identified at time of analysis.
Zitadel versions prior to 4.11.1 and 3.4.7 permit authenticated users to bypass email and phone verification procedures through the self-management feature, allowing them to mark contact information as verified without completing actual validation. This integrity bypass enables account compromise scenarios where attackers with valid credentials can impersonate other users or escalate privileges by falsifying verified contact details. No patch is currently available for affected deployments, though implementing action rules (v2) can mitigate the risk.
Server-Side Request Forgery in Zitadel's Action V2 webhook feature allows unauthenticated attackers to probe internal network services and gather information about internal infrastructure by crafting malicious webhook target URLs pointing to localhost or private IP addresses. The vulnerability affects Zitadel versions 4.0.0 through 4.11.0, with schema validation providing limited mitigation. No patch is currently available.
Zitadel versions 2.31.0 through 3.4.6 and 4.10.x accept truncated opaque OIDC access tokens as valid when shortened to 80 characters, allowing attackers to bypass token validation and gain unauthorized access to protected resources. This affects deployments using the v2 token format where the symmetric encryption scheme fails to properly validate token length, enabling token forgery or reuse attacks.
Zitadel versions prior to 4.9.1 and 3.4.6 contain a user enumeration vulnerability in their login interfaces that allows unauthenticated attackers to discover valid user accounts by testing usernames and user IDs. An attacker can leverage this information disclosure to build lists of existing users for targeted attacks against the identity management platform. The vulnerability has been patched in versions 4.9.1 and 3.4.6.
Authenticated users on affected ZITADEL instances can retrieve the total number of users in the instance through the User Service ListUsers query, because the response's totalResult field is populated without applying per-caller read permissions. Any valid session - including a low-privilege human or machine user with no granted read rights - is sufficient, making this an unauthenticated-data-free but still permission-bypassing aggregate information disclosure (CWE-497). Affected ranges are 2.44.0 through 2.71.19, 3.0.0-rc.1 through 3.4.4, and 4.0.0-rc.1 through 4.7.1; fixes exist in 3.4.5 and 4.7.2. EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so despite a MEDIUM 5.3 CVSS 4.0 score this is a low-priority issue that leaks a user count rather than any individual record or PII.
DOM-based cross-site scripting (XSS) in ZITADEL's login UI v2 (versions 4.0.0-rc.1 through 4.7.0) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by crafting a /logout URL with a malicious post_logout_redirect parameter. Exploitation requires the victim to interact with the link (UI:R) and multiple active sessions in the same browser, and account takeover is fully mitigated for accounts with MFA or Passwordless authentication enabled. No public exploit code has been identified, and the EPSS score is low (0.30%, 21st percentile). Vendor-released patch: 4.7.1.
Unauthenticated server-side request forgery in the ZITADEL Login UI (V2) lets a remote attacker coerce the server into issuing HTTP requests to arbitrary hosts - including internal, non-routable addresses - and read the upstream responses back, turning the identity server into a data-exfiltration and network-segmentation-bypass primitive. All deployments running the V2 Login UI on versions 4.0.0-rc.1 through 4.7.0 are affected, including self-hosted single-instance installations, because the service-URL resolution logic falls back to the attacker-supplied x-zitadel-forward-host header by default; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6). Exploitation is not confirmed as active - the CVE is not in CISA KEV and no public exploit code has been identified - and EPSS is low at 0.44% (37th percentile), though the impact is high enough that patching to 4.7.1 or later, or stripping the header at a fronting proxy, should be treated as a priority rather than an emergency.
ZITADEL is an open source identity management platform. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Second-factor bypass in Zitadel lets a session be treated as fully authenticated after only one authentication factor is verified, so an account with TOTP, U2F, OTP-SMS, or OTP-Email enrolled can be accessed with just the standalone 6-digit code and no password. The flaw affects deployments using the session API v2/v2-beta or the new login UI in Zitadel 4.0.0 through 4.5.0, 3.0.0 through 3.4.2, and 2.53.6 through 2.71.17, but only when the login policy has neither requireMFA nor requireMFAForLocalUsers enabled and the targeted user self-enrolled a second factor anyway. Exploitation requires a low-privileged position (CVSS PR:L) - the attacker must already hold or guess one valid factor, with the brute-forceable six-digit TOTP code being the cheapest entry point - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Online brute-force protection gaps in Zitadel identity infrastructure let remote attackers with a known username repeatedly guess passwords, TOTP codes, and SMS/email OTP codes against default-configured deployments prior to 4.6.0, 3.4.3, and 2.71.18, potentially resulting in account impersonation. The lockout policy that would throttle guesses is disabled by default and was never applied to the newer resource-based session APIs at all, while the vendor's fix (GHSA-xrw9-r35x-x878) enforces the policy everywhere and adds a progressive delay ('tar pit') enabled by default. Rated CVSS v3.1 7.7 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 7.7 by the vendor; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
Zitadel's password reset flow builds the emailed confirmation URL from the request's Forwarded or X-Forwarded-Host header, so an attacker who can inject a forged host value can make the reset link point at a domain they control and harvest the embedded secret code when the victim clicks it, leading to account takeover. Affected are self-hosted deployments prior to 4.6.0, 3.4.3, and 2.71.18, with impact also shown in versions as old as 2.71.17 and 3.4.2; unauthenticated remote attackers (CVSS 3.1 PR:N) are the relevant threat, though the attack requires victim interaction (UI:R) and knowledge of the target's email address. Accounts protected by MFA or Passwordless are explicitly out of reach because the stolen reset code alone cannot satisfy the second factor, and no public exploit code or CISA KEV confirmation is present at time of analysis - risk is real but condition-dependent, concentrated on password-only accounts behind no header-sanitizing proxy.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, no authentication required.
Zitadel is open-source identity infrastructure software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Zitadel is open-source identity infrastructure software. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zitadel is an open source identity management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is an open source identity management platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Zitadel is an open source identity management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Zitadel is an open source identity management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Zitadel is an open source identity management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ZITADEL is an open-source identity infrastructure tool. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is an open source identity management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL users can upload their own avatar image and various image types are allowed. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zitadel is an open source identity management system. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. No vendor patch available.
ZITADEL is an identity infrastructure system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ZITADEL provides identity infrastructure. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
ZITADEL is an identity infrastructure management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
ZITADEL provides identity infrastructure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZITADEL is a combination of Auth0 and Keycloak. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER`. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Authentication bypass in ZITADEL's Login V2 UI (versions 3.0.0 through 4.19.1) allows unauthenticated attackers to take over user accounts, including administrators with MFA completed, by forging unsigned session cookies and guessing time-ordered session IDs around a victim's sign-in to trigger token rotation. Exploitation requires the target to run the affected Login V2 UI and the attacker to hit a narrow timing window; no public exploit code is identified at time of analysis. While the CVE carries a CVSS 4.0 score of 9.2, the independent assessment rates it with high attack complexity (CVSS 3.1 AV:N/AC:H/PR:N/UI:N), reflecting the timing prerequisite.
Authentication bypass in ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 lets an authenticated attacker with organization-administrator permission register a SAML identity provider using their own signing key and then obtain authenticated sessions as any user linked to a different SAML provider on the same instance, including users in other organizations. The flaw stems from the SAML identity-provider intent callback verifying the assertion signature against the provider named in the request URL while resolving the user from the login intent without confirming the two match. This is a genuine high-priority vulnerability, though not a 'spray-and-pray' internet-wide threat; exploitation requires the org-admin prerequisite and that victims authenticate via SAML identity providers. No public exploit identified at time of analysis, and a vendor-released patch exists (4.19.2 and later for 4.x; a fix beyond 3.4.15 for 3.x).
Unauthenticated username-change in ZITADEL's hosted Login V1 UI lets a remote attacker rename any active human account - including administrators - by supplying only the victim's login name, locking legitimate users out of the identity provider. The underlying defect is CWE-306 (missing authentication for a critical function): the change-username handler acts on the account bound to the login flow before any authentication factor is verified, so deployments running ZITADEL 3.0.0 through 4.17.x with Login V1 enabled are exposed, while instances on a newer login flow or already upgraded to 4.18.0+ are not. No public exploit identified at time of analysis and no CISA KEV listing applies; the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L describes a high-integrity, low-availability impact bounded to the Login V1 population, consistent with the VulnCheck-reported CVSS 4.0 score of 8.8.
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim's external identity provider subject, so that the victim's later, legitimate external login is transparently signed into the attacker-controlled account. Affected deployments are ZITADEL before 3.4.14 and 4.x before 4.16.2 that still run the legacy hosted Login V1 UI with at least one external IdP configured; exploitation also requires the attacker to know a valid IDPConfigID and the victim's ExternalUserID, which tempers the 9.3 CVSS 4.0 rating (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the lack of authentication, low attack complexity, and full account-takeover outcome make this a high-priority patch target.
ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users of a deactivated organization to continue signing in, create sessions, and obtain or refresh tokens if they already possess valid credentials, an existing session, or a refresh token. This authenticated access-control bypass primarily impacts offboarding and deprovisioning workflows, as it does not allow an arbitrary external attacker to gain access without prior valid credentials. No public exploit has been identified at time of analysis, and the flaw does not affect active organizations or bypass per-user deactivation.
Account takeover in ZITADEL affects deployments using the hosted Login V1 or V2 UI on versions 3.x before 3.4.14 and 4.x before 4.16.2. Unauthenticated attackers who know a valid login name can enroll an attacker-controlled passkey or other authenticator during an identify-only session, before any primary factor is verified, and then log in as the victim, bypassing passwords and MFA. No public exploit code has been identified at time of analysis, but the vulnerability is rated high risk due to its unauthenticated nature and low complexity.
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected accounts, including administrator accounts, by reading OTP codes from server-action responses when the 'returnCode' OTP delivery type is enabled and the victim has both OTP-Email and OTP-SMS enrolled. The attack requires prior knowledge of the victim's login name and a non-default deployment configuration; instances using standard out-of-band OTP delivery or users without both factors are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but the complete compromise of confidentiality, integrity, and availability of targeted identities warrants immediate patching.
Unauthenticated remote attackers who know a valid user's login name can enroll attacker-controlled multi-factor authentication factors - including TOTP, OTP-SMS, OTP-Email, and U2F - and overwrite the victim's verified phone number in ZITADEL deployments that expose the legacy hosted Login V1 UI. Affected versions are 3.x before 3.4.15 and 4.x before 4.17.1. The flaw resides in second-factor enrollment and initialization handlers that act on an identify-only session before any primary factor is verified, and it also lets attackers enumerate valid usernames through discrepant error responses. No public exploit code has been identified at time of analysis, but this is a genuine high-priority risk given the low prerequisite (only a login name) and high integrity impact (CVSS 8.8; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:N).
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker who holds user-write permission in one organization to request a passkey or passwordless enrollment code for a user in a different organization on the same multi-tenant instance, then register their own authenticator and seize that account. The flaw is an improper authorization check (CWE-862): the server validates the organization named in the x-zitadel-orgid header instead of the target user's actual organization. Exploitation requires a deployment hosting at least two organizations plus a valid low-privileged user-write role, so single-organization instances and instances already on 3.4.15 or 4.17.1+ are not affected; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Session hijacking and theft of external IdP tokens in ZITADEL 4.x before 4.17.3 and ZITADEL 3.x through 3.4.15 stem from IdP intent tokens that are encrypted without integrity protection, so an authenticated user (CVSS PR:L) can tamper with a token issued for their own login intent and have it accepted for another user's intent. An attacker who correctly predicts a victim's in-flight intent identifier and wins a timing race while the victim is completing an external IdP login can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or take over the resulting session. The impact is genuine but conditional rather than a mass-exploitable issue: it requires a valid authenticated account, an actively logging-in victim, correct identifier prediction, and a narrow race window (AC:H and AT:P in the assessed vector), and no public exploit identified at time of analysis; upgrading to 4.17.3 (or the corresponding fixed 3.x release) removes the condition.
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated remote attacker who knows a victim's login name can bind an external identity provider (IdP) identity they control to the victim's account and then sign in as that user, obtaining full control of the account and its data. The root cause is that the account-to-IdP linking flow neither verifies a primary authentication factor nor checks the caller's permission, and it is reachable through two distinct paths named in the advisory - identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. The vendor has published a fix for the 4.x line in 4.17.3, no public exploit code was identified at time of analysis, and this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact because exploitation requires only knowledge of the victim's login name and network reachability.
MFA bypass in ZITADEL Login V2 (versions 4.0.0 through 4.16.0) lets an attacker who already holds a victim's valid first-factor password complete an OIDC or SAML login to a customer application without ever satisfying the user's voluntarily enrolled TOTP, OTP, or U2F second factor. The browser session created after password verification is reused when the login flow is abandoned at the MFA step and restarted, and the pre-fix session-validity check only demanded MFA when the organization had Force MFA or Force MFA for local users enabled. The assessed CVSS 3.1 vector is 8.2 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflecting the requirement of the victim's password; Login V1, the ZITADEL Console, Management/Admin APIs, and user self-management are unaffected, a vendor patch is available as 4.16.1, and no public exploit code has been identified at time of analysis.
ZITADEL Actions V1 on affected releases (3.0.0 through pre-3.4.13 and the 4.x line before 4.16.1) fails to restrict the goja Node-compatible require() registry, so an authenticated organization Action author holding ORG_OWNER, org.action.write, and org.flow.write can execute JavaScript at OIDC, SAML, or login-flow triggers and load arbitrary files readable by the ZITADEL server process. This exposes mounted configuration and secrets - notably credentials referenced by ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH and ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH - and recovered bootstrap credentials can let an organization administrator escalate to instance administrator; host command execution is not established. CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a high-privilege prerequisite; no public exploit code has been identified at time of analysis, and the issue is patched in 3.4.13 and 4.16.1.
Privilege escalation in ZITADEL identity platform (before 4.15.3) allows an attacker holding a low-privilege OAuth2 token to exchange it for elevated permissions at a different application, because the token-exchange endpoint fails to bind the subject token to the requesting client and does not constrain requested scopes to the original token's scopes. Any authenticated principal with a valid low-scope token can escalate laterally across relying applications; no public exploit is identified at time of analysis and it is not listed in CISA KEV. A vendor patch (4.15.3) and fixing commit are available.
Stored cross-site scripting in ZITADEL's Login V2 (versions prior to 4.15.3) lets an organization or instance administrator plant a javascript: or data: URI in the loginSettings.defaultRedirectUri, which is passed to router.push on OIDC and SAML FailedPrecondition error paths without the isSafeRedirectUri validation, executing arbitrary script in a victim user's browser. Because the malicious value must be set by a privileged admin and only fires when a user hits a specific login error path, this is a privilege-escalation/session-compromise vector against the self-hosted identity platform rather than a mass-exploitable flaw. No public exploit identified at time of analysis; not listed in CISA KEV.
ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by insufficient session expiration (CVSS 7.4).
ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by authorization bypass through user-controlled key (CVSS 7.7).
ZITADEL is an open source identity management platform. From 2.68.0 to versions up to 3.4.8 contains a security vulnerability (CVSS 7.5).
ZITADEL is an open source identity management platform. [CVSS 8.2 HIGH]
Account takeover in Zitadel versions 4.0.0 through 4.11.1 is possible through improper redirect URI validation in the login V2 interface, allowing attackers with high privileges to compromise user accounts. This cross-site scripting vulnerability affects organizations using the vulnerable Zitadel identity management platform and has been resolved in version 4.12.0.
Stored XSS in ZITADEL identity management platform versions 4.0.0 to 4.11.1 allows unauthenticated attackers to inject persistent scripts through the login flow. Patch available.
ZITADEL versions 4.0.0-rc.1 through 4.7.0 are vulnerable to open redirect attacks through improper validation of the Forwarded and X-Forwarded-Host headers used in password reset links. An attacker can craft a malicious request to redirect users to an attacker-controlled domain when they click password reset confirmation links, enabling credential harvesting or phishing attacks. The vulnerability affects all deployments using affected versions and has been patched in version 4.7.1.
Privilege escalation in ZITADEL 3.0.0 through 4.19.1 lets accounts that already hold the IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role obtain tokens for administrators, including IAM_OWNER, and sign in to relying applications carrying those administrators' roles and claims, because the OIDC token-exchange flow fails to enforce the admin.impersonation check (CWE-863). Exploitation requires the high-privilege prerequisite that an end-user impersonator role has been deliberately granted (CVSS PR:H), so arbitrary authenticated users and unauthenticated attackers cannot trigger it, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor fixed the bypass in ZITADEL 4.19.2.
Zitadel deployments before 4.16.2 expose a server-side request forgery (SSRF) path in the organization custom-domain HTTP verification flow, where the challenge fetch uses Go's default http.Get rather than Zitadel's SSRF-protected HTTP client. An authenticated principal holding privileges to create or manage an organization and register a custom domain can point DNS/HTTP for that domain at loopback, RFC1918/internal, or link-local cloud metadata addresses (e.g., 169.254.169.254), causing the Zitadel server to issue requests to those targets and enabling port scanning and internal network mapping. Impact is limited to server-side reconnaissance - there is no data modification, and confidentiality exposure depends on what internal or metadata services are actually reachable from the instance - and no public exploit code has been identified at time of analysis; EPSS and KEV signals are absent, and the scored severity is low (CVSS v4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Cross-organization information disclosure in ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 allows an authenticated user who holds an organization-scoped user.read permission to retrieve the authentication method types registered by users in other organizations by calling GET /v2/users/{userId}/authentication_methods. The User Service API validates user.read against the caller's own organization rather than the organization that owns the target user (CWE-863 incorrect authorization), so tenant isolation is broken on multi-organization deployments. Exploitation requires a valid account with org-scoped user.read (PR:L per the assessed vector) and knowledge or enumeration of foreign-org user IDs; impact is limited to method-type disclosure with no credential, token, or account modification exposure, and no public exploit code was identified at time of analysis. CVSS 4.0 base 5.3 and our independent assessment of 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree that this is a medium-severity confidentiality issue.
Account takeover in ZITADEL's external identity provider auto-linking logic prior to version 4.15.3 allows an unauthenticated network attacker to hijack a victim's local ZITADEL account. The handler confirms that the local user's email is verified but fails to require the external IdP to also confirm ownership of that same email address before completing the link - meaning an attacker who registers a victim's email on a permissive external IdP (one that does not enforce email verification) can silently gain full access to the victim's ZITADEL account. No public exploit has been identified at time of analysis; the fix is available in the vendor-released patch v4.15.3.
Insufficient JWT expiration enforcement in ZITADEL's external JWT Identity Provider integration allows tokens lacking the `exp` claim to be treated as indefinitely valid, bypassing intended session lifetime controls. Versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1 are affected, with the flaw residing in `internal/idp/providers/jwt/session.go`. An attacker who can obtain or craft a JWT from a configured trusted external issuer that omits the `exp` claim can maintain persistent authenticated access without re-authentication. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Insufficient session expiration in ZITADEL's external JWT Identity Provider allows arbitrarily old tokens from trusted issuers to pass authentication when the token omits the iat (issued-at) claim. ZITADEL versions prior to 3.4.12 (v3 branch) and 4.15.2 (v4 branch) are affected. An attacker holding a previously issued JWT from a trusted external IdP - specifically one lacking the iat claim - can reuse that token indefinitely, bypassing intended session expiry controls and maintaining unauthorized access. No public exploit identified at time of analysis.
Zitadel versions prior to 4.11.1 and 3.4.7 permit authenticated users to bypass email and phone verification procedures through the self-management feature, allowing them to mark contact information as verified without completing actual validation. This integrity bypass enables account compromise scenarios where attackers with valid credentials can impersonate other users or escalate privileges by falsifying verified contact details. No patch is currently available for affected deployments, though implementing action rules (v2) can mitigate the risk.
Server-Side Request Forgery in Zitadel's Action V2 webhook feature allows unauthenticated attackers to probe internal network services and gather information about internal infrastructure by crafting malicious webhook target URLs pointing to localhost or private IP addresses. The vulnerability affects Zitadel versions 4.0.0 through 4.11.0, with schema validation providing limited mitigation. No patch is currently available.
Zitadel versions 2.31.0 through 3.4.6 and 4.10.x accept truncated opaque OIDC access tokens as valid when shortened to 80 characters, allowing attackers to bypass token validation and gain unauthorized access to protected resources. This affects deployments using the v2 token format where the symmetric encryption scheme fails to properly validate token length, enabling token forgery or reuse attacks.
Zitadel versions prior to 4.9.1 and 3.4.6 contain a user enumeration vulnerability in their login interfaces that allows unauthenticated attackers to discover valid user accounts by testing usernames and user IDs. An attacker can leverage this information disclosure to build lists of existing users for targeted attacks against the identity management platform. The vulnerability has been patched in versions 4.9.1 and 3.4.6.
Authenticated users on affected ZITADEL instances can retrieve the total number of users in the instance through the User Service ListUsers query, because the response's totalResult field is populated without applying per-caller read permissions. Any valid session - including a low-privilege human or machine user with no granted read rights - is sufficient, making this an unauthenticated-data-free but still permission-bypassing aggregate information disclosure (CWE-497). Affected ranges are 2.44.0 through 2.71.19, 3.0.0-rc.1 through 3.4.4, and 4.0.0-rc.1 through 4.7.1; fixes exist in 3.4.5 and 4.7.2. EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so despite a MEDIUM 5.3 CVSS 4.0 score this is a low-priority issue that leaks a user count rather than any individual record or PII.
DOM-based cross-site scripting (XSS) in ZITADEL's login UI v2 (versions 4.0.0-rc.1 through 4.7.0) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by crafting a /logout URL with a malicious post_logout_redirect parameter. Exploitation requires the victim to interact with the link (UI:R) and multiple active sessions in the same browser, and account takeover is fully mitigated for accounts with MFA or Passwordless authentication enabled. No public exploit code has been identified, and the EPSS score is low (0.30%, 21st percentile). Vendor-released patch: 4.7.1.
Unauthenticated server-side request forgery in the ZITADEL Login UI (V2) lets a remote attacker coerce the server into issuing HTTP requests to arbitrary hosts - including internal, non-routable addresses - and read the upstream responses back, turning the identity server into a data-exfiltration and network-segmentation-bypass primitive. All deployments running the V2 Login UI on versions 4.0.0-rc.1 through 4.7.0 are affected, including self-hosted single-instance installations, because the service-URL resolution logic falls back to the attacker-supplied x-zitadel-forward-host header by default; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6). Exploitation is not confirmed as active - the CVE is not in CISA KEV and no public exploit code has been identified - and EPSS is low at 0.44% (37th percentile), though the impact is high enough that patching to 4.7.1 or later, or stripping the header at a fronting proxy, should be treated as a priority rather than an emergency.
ZITADEL is an open source identity management platform. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Second-factor bypass in Zitadel lets a session be treated as fully authenticated after only one authentication factor is verified, so an account with TOTP, U2F, OTP-SMS, or OTP-Email enrolled can be accessed with just the standalone 6-digit code and no password. The flaw affects deployments using the session API v2/v2-beta or the new login UI in Zitadel 4.0.0 through 4.5.0, 3.0.0 through 3.4.2, and 2.53.6 through 2.71.17, but only when the login policy has neither requireMFA nor requireMFAForLocalUsers enabled and the targeted user self-enrolled a second factor anyway. Exploitation requires a low-privileged position (CVSS PR:L) - the attacker must already hold or guess one valid factor, with the brute-forceable six-digit TOTP code being the cheapest entry point - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Online brute-force protection gaps in Zitadel identity infrastructure let remote attackers with a known username repeatedly guess passwords, TOTP codes, and SMS/email OTP codes against default-configured deployments prior to 4.6.0, 3.4.3, and 2.71.18, potentially resulting in account impersonation. The lockout policy that would throttle guesses is disabled by default and was never applied to the newer resource-based session APIs at all, while the vendor's fix (GHSA-xrw9-r35x-x878) enforces the policy everywhere and adds a progressive delay ('tar pit') enabled by default. Rated CVSS v3.1 7.7 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 7.7 by the vendor; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
Zitadel's password reset flow builds the emailed confirmation URL from the request's Forwarded or X-Forwarded-Host header, so an attacker who can inject a forged host value can make the reset link point at a domain they control and harvest the embedded secret code when the victim clicks it, leading to account takeover. Affected are self-hosted deployments prior to 4.6.0, 3.4.3, and 2.71.18, with impact also shown in versions as old as 2.71.17 and 3.4.2; unauthenticated remote attackers (CVSS 3.1 PR:N) are the relevant threat, though the attack requires victim interaction (UI:R) and knowledge of the target's email address. Accounts protected by MFA or Passwordless are explicitly out of reach because the stolen reset code alone cannot satisfy the second factor, and no public exploit code or CISA KEV confirmation is present at time of analysis - risk is real but condition-dependent, concentrated on password-only accounts behind no header-sanitizing proxy.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, no authentication required.
Zitadel is open-source identity infrastructure software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity.
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Zitadel is open-source identity infrastructure software. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Zitadel is an open source identity management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is an open source identity management platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Zitadel is an open source identity management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Zitadel is an open source identity management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Zitadel is an open source identity management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ZITADEL is an open-source identity infrastructure tool. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Zitadel is an open source identity management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL users can upload their own avatar image and various image types are allowed. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zitadel is an open source identity management system. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. No vendor patch available.
ZITADEL is an identity infrastructure system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ZITADEL provides identity infrastructure. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
ZITADEL is an identity infrastructure management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
ZITADEL provides identity infrastructure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZITADEL is a combination of Auth0 and Keycloak. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER`. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.