[ Vendor · 16 CVEs ]
zitadel
CVEs affecting zitadel published in the last 30 days, plus any zitadel CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109373 | 12 Oct 2026 | CVSS 8.1 | zitadelZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other… | |
| CVE-2026-109374 | 12 Oct 2026 | CVSS 5.5 | zitadelZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate… | |
| CVE-2026-109371 | 12 Oct 2026 | CVSS 8.2 | zitadelZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the… | |
| CVE-2026-109372 | 12 Oct 2026 | CVSS 8.7 | zitadelZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the… | |
| CVE-2026-105209 | 4 Oct 2026 | CVSS 9.6 | zitadelZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment… | |
| CVE-2026-105210 | 4 Oct 2026 | CVSS 8.2 | zitadelZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and… | |
| CVE-2026-105211 | 4 Oct 2026 | CVSS 8.1 | zitadelZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by… | |
| CVE-2026-105212 | 4 Oct 2026 | CVSS 7.5 | zitadelZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or… | |
| CVE-2026-105213 | 4 Oct 2026 | CVSS 8.2 | zitadelZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's… | |
| CVE-2026-105214 | 4 Oct 2026 | CVSS 2.3 | zitadelZitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources… | |
| CVE-2026-105215 | 4 Oct 2026 | CVSS 9.1 | zitadelZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found'… | |
| CVE-2026-105206 | 4 Oct 2026 | CVSS 5.3 | zitadelZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against… | |
| CVE-2026-105207 | 4 Oct 2026 | CVSS 9.8 | zitadelZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary… | |
| CVE-2026-105208 | 4 Oct 2026 | CVSS 7.7 | zitadelZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users… | |
| CVE-2026-85056 | 24 Sep 2026 | CVSS 8.2 | ZITADEL: MFA bypass via session reuse in Login V2ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password… | Fix |
| CVE-2026-85057 | 24 Sep 2026 | CVSS 8.7 | ZITADEL: Actions V1 sandbox escape: host file read via require()ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible… | Fix |