CVEs we hold for Zitadel
Records whose assigning authority named Zitadel as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletionszitadel CVE-2026-56668ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchangezitadel CVE-2026-56667ZITADEL: Stored XSS via Default URI Redirect in Login V2zitadel CVE-2026-56666ZITADEL: Auto-linking by email: IdP-side email verification is not checkedzitadel CVE-2026-56665ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Providerzitadel CVE-2026-56664ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Providerzitadel CVE-2026-55672ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3…zitadel CVE-2026-55671ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Componentszitadel CVE-2026-55670ZITADEL: Cross-Tenant User Leakage via Recycled Identifierszitadel CVE-2026-55669ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Providerzitadel CVE-2026-54693ZITADEL Users Can Self-Verify Email/Phone via APIzitadel CVE-2026-33132ZITADEL is missing enforcement of organization scopeszitadel CVE-2026-32132ZITADEL: Reactivation of Expired Passkey Registration Codeszitadel CVE-2026-32131ZITADEL Cross-Tenant Information Disclosure in Management APIzitadel CVE-2026-32130ZITADEL SCIM Authentication Bypass via URL Encodingzitadel CVE-2026-29193ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2zitadel CVE-2026-29192ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeoverzitadel CVE-2026-29191ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpointzitadel CVE-2026-29067ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Loginzitadel CVE-2026-27946ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIzitadel CVE-2026-27840ZITADEL's truncated opaque tokens are still validzitadel CVE-2026-23511ZITADEL has a user enumeration vulnerability in Login UIszitadel CVE-2025-67717Zitadel Discloses the Total Number of Instance Userszitadel CVE-2025-67495ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Loginzitadel CVE-2025-67494ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel CVE-2025-64717ZITADEL vulnerable to Account Takeover with deactivated Instance IdPzitadel CVE-2025-64431IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Temperingzitadel CVE-2025-64102Zitadel allows brute-forcing authentication factorszitadel CVE-2025-64101ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injectionzitadel CVE-2025-57770ZITADEL user enumeration vulnerability in login UIzitadel CVE-2025-53895ZITADEL has broken authN and authZ in session API and resulting session tokenszitadel CVE-2025-48936ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injectionzitadel CVE-2025-31124Zitadel allows User Enumeration by loginname attribute normalizationzitadel CVE-2025-31123Zitadel Expired JWT Keys Usable for Authorization Grantszitadel CVE-2025-27507IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurationszitadel CVE-2024-47060Unauthorized Access After Organization or Project Deactivation in Zitadelzitadel CVE-2024-47000Service Users Deactivation not Working in Zitadelzitadel CVE-2024-41953Zitadel improperly sanitizes HTML in emails and Console UIzitadel CVE-2024-41952Zitadel has an "Ignoring unknown usernames" vulnerabilityzitadel CVE-2024-39683ZITADEL Vulnerable to Session Information Leakagezitadel CVE-2024-32967Zitadel exposes internal database user name and host informationzitadel CVE-2024-32868ZITADEL's Improper Lockout Mechanism Leads to MFA Bypasszitadel CVE-2024-29891ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypasszitadel CVE-2024-28197Account Takeover via Session Fixation in Zitadel [Bypassing MFA]zitadel CVE-2023-49097ZITADEL vulnerable account takeover via malicious host header injectionzitadel CVE-2023-47111ZITADEL race condition in lockout policy executionzitadel CVE-2023-44399ZITADEL's password reset does not respect the "Ignoring unknown usernames" settingzitadel 59 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.