Security
فارسی
All products

github.com/zitadel/zitadel/v2

Go · Package
15 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
ZITADEL has potential SSRF via ActionsCVE-2026-27945 · GHSA-7777-FHQ9-592V github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go Low Fix reported
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header InjectionCVE-2025-48936 · GHSA-93M4-MFPG-C3XFVersion ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL has 1-Click Account Takeover via XSS in /saml-post EndpointCVE-2026-29191 · GHSA-PR34-2V5X-6QJQVersion ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go Critical Fix reported
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and AuthenticationCVE-2026-29193 · GHSA-25RW-G6FF-FMG8Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverCVE-2026-29192 · GHSA-6RX5-M2RC-HMF7Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 LoginCVE-2026-29067 · GHSA-PFRF-9R5F-73F5Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 LoginCVE-2025-67494 · GHSA-7WFC-4796-GMG5Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go Critical Fix reported
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginCVE-2025-67495 · GHSA-V959-QXV6-6F8PVersion ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
Zitadel May Bypass Second Authentication FactorCVE-2025-64103 · GHSA-CFJQ-28R2-4JV5Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
Zitadel allows brute-forcing authentication factorsCVE-2025-64102 · GHSA-XRW9-R35X-X878Version ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionCVE-2025-64101 · GHSA-MWMH-7PX9-4C23 github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP ConfigurationsCVE-2025-27507 · GHSA-F3GH-529W-V32XVersion ranges need review. github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go Critical Fix reported
ZITADEL Allows Unauthorized Access After Organization or Project DeactivationCVE-2024-47060 · GHSA-JJ94-6F5C-65R8 github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL's Service Users Deactivation not Working CVE-2024-47000 · GHSA-QR2H-7PWM-H393 github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported
ZITADEL's User Grant Deactivation not WorkingCVE-2024-46999 · GHSA-2W5J-QFVW-2HF5 github.com/zitadel/zitadel/v2github.com/zitadel/zitadel Go High Fix reported