CVE-2026-54693 | | | 2026-07-29 | ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone… |
CVE-2026-56668 | High | 8.1 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-ex… |
CVE-2026-56667 | High | 7.3 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.def… |
CVE-2026-56666 | Medium | 4.8 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is ver… |
CVE-2026-56665 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 thr… |
CVE-2026-56664 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/provide… |
CVE-2026-55672 | High | 7.4 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flow… |
CVE-2026-55671 | | | 2026-07-10 | ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML… |
CVE-2026-55670 | | | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted… |
CVE-2026-55669 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and… |
CVE-2026-44671 | High | 7.5 | 2026-05-14 | ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity pro… |
CVE-2026-33132 | Medium | 5.3 | 2026-03-20 | ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement durin… |
CVE-2026-32132 | High | 7.4 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints… |
CVE-2026-32131 | High | 7.7 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed… |
CVE-2026-32130 | High | 7.5 | 2026-03-11 | ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management… |
CVE-2026-29193 | High | 8.2 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login be… |
CVE-2026-29192 | High | 7.7 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allow… |
CVE-2026-29191 | Critical | 9.3 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allow… |
CVE-2026-29067 | High | 8.1 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanis… |
CVE-2026-27946 | Medium | 6.5 | 2026-02-26 | ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed use… |
CVE-2026-27945 | Medium | 6.5 | 2026-02-26 | ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook b… |
CVE-2026-27840 | Medium | 4.3 | 2026-02-26 | ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2… |
CVE-2026-23511 | Medium | 5.3 | 2026-01-15 | ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login inter… |
CVE-2025-67717 | Medium | 4.3 | 2025-12-11 | ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users… |
CVE-2025-67495 | High | 8.0 | 2025-12-09 | ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoin… |
CVE-2025-67494 | Critical | 9.3 | 2025-12-09 | ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADE… |
CVE-2025-64717 | Critical | 9.8 | 2025-11-13 | ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL'… |
CVE-2025-64431 | | | 2025-11-07 | Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks throu… |
CVE-2025-64103 | Critical | 9.8 | 2025-10-29 | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMF… |
CVE-2025-64102 | Critical | 9.8 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP… |
CVE-2025-64101 | High | 8.1 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mecha… |
CVE-2025-57770 | Medium | 5.3 | 2025-08-22 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6… |
CVE-2025-53895 | High | 8.8 | 2025-07-15 | ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability i… |
CVE-2025-48936 | High | 8.1 | 2025-05-30 | Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset… |
CVE-2025-46815 | High | 8.0 | 2025-05-06 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for… |
CVE-2025-31124 | Medium | 5.3 | 2025-03-31 | Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a… |
CVE-2025-31123 | High | 8.7 | 2025-03-31 | Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails… |
CVE-2025-27507 | Critical | 9.0 | 2025-03-04 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Dir… |
CVE-2024-49757 | High | 7.5 | 2024-10-25 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versio… |
CVE-2024-49753 | Medium | 5.9 | 2024-10-25 | Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL va… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47000 | High | 8.1 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated… |
CVE-2024-46999 | High | 7.3 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still… |
CVE-2024-41953 | Medium | 4.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That informat… |
CVE-2024-41952 | Medium | 5.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate atta… |
CVE-2024-39683 | Medium | 5.7 | 2024-07-03 | ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Start… |
CVE-2024-32967 | Medium | 5.3 | 2024-05-01 | Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and… |
CVE-2024-32868 | Medium | 6.5 | 2024-04-26 | ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already give… |
CVE-2024-29892 | Medium | 6.1 | 2024-03-27 | ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved cla… |
CVE-2024-29891 | High | 8.7 | 2024-03-27 | ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an… |
CVE-2024-28855 | High | 8.1 | 2024-03-18 | ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the… |
CVE-2024-28197 | High | 7.5 | 2024-03-11 | Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie wa… |
CVE-2023-49097 | High | 8.1 | 2023-11-30 | ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link s… |
CVE-2023-47111 | High | 7.3 | 2023-11-08 | ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password… |
CVE-2023-46238 | High | 8.7 | 2023-10-26 | ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can inclu… |
CVE-2023-44399 | Medium | 5.3 | 2023-10-10 | ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which h… |
CVE-2023-22492 | Medium | 5.9 | 2023-01-11 | ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the us… |
CVE-2022-36051 | High | 8.7 | 2022-08-31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a fe… |