| ZITADEL: MFA bypass via session reuse in Login V2CVE-2026-85056 · GHSA-9993-RFWP-RHWFVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL: Actions V1 sandbox escape: host file read via require()CVE-2026-85057 · GHSA-FGMF-7RF8-M6VFVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role DeletionsCVE-2026-76081 · GHSA-V859-C572-QH5PVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderCVE-2026-56665 · GHSA-V77H-2W3M-94HXVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL: Auto-linking by email: IdP-side email verification is not checkedCVE-2026-56666 · GHSA-992Q-9GWP-7R79Version ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeCVE-2026-56668 · GHSA-VRH8-C9CM-WH8VVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| Zitadel is missing enforcement of organization scopesCVE-2026-33132 · GHSA-G2PF-WW5M-2R9MVersion ranges need review. |
github.com/zitadel/zitadelRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-multicluster-observability-addon-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| ZITADEL Vulnerable to Session Information LeakageCVE-2024-39683 · GHSA-CVW9-C57H-3397Version ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL's Improper Lockout Mechanism Leads to MFA BypassCVE-2024-32868 · GHSA-7J7J-66CV-M239Version ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| Improper HTML sanitization in ZITADELCVE-2024-28855 · GHSA-HFRG-4JWR-JFPJVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP BypassCVE-2024-29891 · GHSA-HR5W-CWWQ-2V4MVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| Account Takeover via Session Fixation in Zitadel [Bypassing MFA]CVE-2024-28197 · GHSA-MQ4X-R2W3-J7MRVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL's actions can overload reserved claimsCVE-2024-29892 · GHSA-GP8G-F42F-95Q2Version ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL's password reset does not respect the "Ignoring unknown usernames" settingCVE-2023-44399 · GHSA-V683-RCXX-VPFF |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL Account Takeover via Malicious Host Header InjectionCVE-2023-49097 · GHSA-2WMJ-46RJ-QM2W |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL race condition in lockout policy executionCVE-2023-47111 · GHSA-7H8M-VRXX-VR4M |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| Zitadel RefreshToken invalidation vulnerabilityCVE-2023-22492 · GHSA-6RRR-78XP-5JP8 |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| Zitadel exposing internal database user name and host informationCVE-2024-32967 · GHSA-Q5QJ-X2H5-3945Version ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
| ZITADEL Users Can Self-Verify Email/Phone via APICVE-2026-54693 · GHSA-JQ8W-8Q2F-FFM9Version ranges need review. |
github.com/zitadel/zitadel |
Go |
High
|
Fix reported |
|
| ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderCVE-2026-56664 · GHSA-WXG7-W2V3-W38GVersion ranges need review. |
github.com/zitadel/zitadel |
Go |
Medium
|
Fix reported |
|
