What is CVE-2026-56667?

CVE-2026-56667 is a high-severity vulnerability in Zitadel, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2026-07-10.

How severe is CVE-2026-56667?

High severity. CVSS v3 base score is 7.3 out of 10.

XSS in Zitadel

CVE-2026-56667

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, all…

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N.

Affected products

Zitadel — versions < 4.15.3

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-56667?: CVE-2026-56667 is a high-severity vulnerability in Zitadel, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2026-07-10.
How severe is CVE-2026-56667?: High severity. CVSS v3 base score is 7.3 out of 10.