zitadel records

47 published records for vendor zitadel.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 95.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

47 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2026-29191No exploit	ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpointzitadel · zitadel · CWE-79 Pre-auth XSS	Critical9.3	—	0.4%	Mar 7, 2026
37Monitor	CVE-2026-29067No exploit	ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Loginzitadel · zitadel · CWE-601 Pre-auth Open redirect	Critical9.3	—	0.3%	Mar 7, 2026
36Monitor	CVE-2024-49753No exploit	Denied Host Validation Bypass in Zitadel Actionszitadel · zitadel · CWE-20 Pre-auth	Critical9.1	—	0.6%	Oct 25, 2024
36Monitor	CVE-2025-27507No exploit	IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurationszitadel · zitadel · CWE-639 Broken access control (IDOR)	Critical9.0	—	0.6%	Mar 4, 2025
35Monitor	CVE-2022-36051No exploit	Broken Authorization in ZITADEL Actionszitadel · zitadel · CWE-436	High8.8	—	1.0%	Aug 31, 2022
35Monitor	CVE-2023-49097No exploit	ZITADEL vulnerable account takeover via malicious host header injectionzitadel · zitadel · CWE-640 Pre-auth	High8.8	—	0.7%	Nov 30, 2023
35Monitor	CVE-2025-48936No exploit	ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injectionzitadel · zitadel · CWE-601 Pre-auth Open redirect	High8.8	—	0.4%	May 30, 2025
35Monitor	CVE-2025-64101No exploit	ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injectionzitadel · zitadel · CWE-601 Pre-auth Open redirect	High8.8	—	0.3%	Oct 29, 2025
34Monitor	CVE-2024-29891No exploit	ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypasszitadel · zitadel · CWE-434 File upload XSS	High8.7	—	0.7%	Mar 27, 2024
34Monitor	CVE-2025-67494Proof of concept	ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel · zitadel · CWE-918 Pre-auth SSRF	High8.6	—	0.4%	Dec 9, 2025
34Monitor	CVE-2025-31123No exploit	Zitadel Expired JWT Keys Usable for Authorization Grantszitadel · zitadel · CWE-324	High8.7	—	0.4%	Mar 31, 2025
34Monitor	CVE-2025-64103No exploit	Zitadel Bypass Second Authentication Factorzitadel · zitadel · CWE-287 Auth bypass	High8.7	—	0.3%	Oct 29, 2025
32Monitor	CVE-2025-46815No exploit	ZITADEL Allows IdP Intent Token Reusezitadel · zitadel · CWE-294 Pre-auth Auth bypass	High8.0	—	0.4%	May 6, 2025
32Monitor	CVE-2024-32868Proof of concept	ZITADEL's Improper Lockout Mechanism Leads to MFA Bypasszitadel · zitadel · CWE-297 Weak crypto	High8.1	—	0.4%	Apr 25, 2024
32Monitor	CVE-2026-29193No exploit	ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2zitadel · zitadel · CWE-287 Pre-auth Auth bypass	High8.2	—	0.3%	Mar 7, 2026
32Monitor	CVE-2026-27946No exploit	ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIzitadel · zitadel · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Feb 25, 2026
30Monitor	CVE-2026-32130No exploit	ZITADEL SCIM Authentication Bypass via URL Encodingzitadel · zitadel · CWE-288 Pre-auth Auth bypass	High7.5	—	0.6%	Mar 11, 2026
30Monitor	CVE-2026-44671No exploit	ZITADEL: LDAP Filter Injection in Login Flowzitadel · zitadel · CWE-90 Pre-auth Auth bypass	High7.5	—	0.4%	May 14, 2026
30Monitor	CVE-2026-32131No exploit	ZITADEL Cross-Tenant Information Disclosure in Management APIzitadel · zitadel · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	Mar 11, 2026
30Monitor	CVE-2025-53895No exploit	ZITADEL has broken authN and authZ in session API and resulting session tokenszitadel · zitadel · CWE-384	High7.7	—	0.4%	Jul 15, 2025
30Monitor	CVE-2024-47000No exploit	Service Users Deactivation not Working in Zitadelzitadel · zitadel · CWE-269 Pre-auth	High7.5	—	0.4%	Sep 19, 2024
30Monitor	CVE-2025-64102No exploit	Zitadel allows brute-forcing authentication factorszitadel · zitadel · CWE-307	High7.7	—	0.3%	Oct 29, 2025
30Monitor	CVE-2026-29192No exploit	ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeoverzitadel · zitadel · CWE-79 XSS	High7.7	—	0.3%	Mar 7, 2026
30Monitor	CVE-2024-28197No exploit	Account Takeover via Session Fixation in Zitadel [Bypassing MFA]zitadel · zitadel · CWE-269 Pre-auth XSS	High7.5	—	0.3%	Mar 11, 2024
29Monitor	CVE-2025-64717No exploit	ZITADEL vulnerable to Account Takeover with deactivated Instance IdPzitadel · zitadel · CWE-287 Auth bypass	High7.4	—	0.4%	Nov 13, 2025

CVE-2026-29191
37Monitor
ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
zitadel · zitadelMar 7, 2026
CVE-2026-29067
37Monitor
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Open redirect
zitadel · zitadelMar 7, 2026
CVE-2024-49753
36Monitor
Denied Host Validation Bypass in Zitadel Actions
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
zitadel · zitadelOct 25, 2024
CVE-2025-27507
36Monitor
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
CriticalCVSS 9.0No exploitEPSS 0%
- Broken access control (IDOR)
zitadel · zitadelMar 4, 2025
CVE-2022-36051
35Monitor
Broken Authorization in ZITADEL Actions
HighCVSS 8.8No exploitEPSS 1%
zitadel · zitadelAug 31, 2022
CVE-2023-49097
35Monitor
ZITADEL vulnerable account takeover via malicious host header injection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
zitadel · zitadelNov 30, 2023
CVE-2025-48936
35Monitor
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Open redirect
zitadel · zitadelMay 30, 2025
CVE-2025-64101
35Monitor
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Open redirect
zitadel · zitadelOct 29, 2025
CVE-2024-29891
34Monitor
ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
HighCVSS 8.7No exploitEPSS 0%
- File upload
- XSS
zitadel · zitadelMar 27, 2024
CVE-2025-67494
34Monitor
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
- SSRF
zitadel · zitadelDec 9, 2025
CVE-2025-31123
34Monitor
Zitadel Expired JWT Keys Usable for Authorization Grants
HighCVSS 8.7No exploitEPSS 0%
zitadel · zitadelMar 31, 2025
CVE-2025-64103
34Monitor
Zitadel Bypass Second Authentication Factor
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
zitadel · zitadelOct 29, 2025
CVE-2025-46815
32Monitor
ZITADEL Allows IdP Intent Token Reuse
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
zitadel · zitadelMay 6, 2025
CVE-2024-32868
32Monitor
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
HighCVSS 8.1Proof of conceptEPSS 0%
- Weak crypto
zitadel · zitadelApr 25, 2024
CVE-2026-29193
32Monitor
ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
zitadel · zitadelMar 7, 2026
CVE-2026-27946
32Monitor
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
zitadel · zitadelFeb 25, 2026
CVE-2026-32130
30Monitor
ZITADEL SCIM Authentication Bypass via URL Encoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
zitadel · zitadelMar 11, 2026
CVE-2026-44671
30Monitor
ZITADEL: LDAP Filter Injection in Login Flow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
zitadel · zitadelMay 14, 2026
CVE-2026-32131
30Monitor
ZITADEL Cross-Tenant Information Disclosure in Management API
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
zitadel · zitadelMar 11, 2026
CVE-2025-53895
30Monitor
ZITADEL has broken authN and authZ in session API and resulting session tokens
HighCVSS 7.7No exploitEPSS 0%
zitadel · zitadelJul 15, 2025
CVE-2024-47000
30Monitor
Service Users Deactivation not Working in Zitadel
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
zitadel · zitadelSep 19, 2024
CVE-2025-64102
30Monitor
Zitadel allows brute-forcing authentication factors
HighCVSS 7.7No exploitEPSS 0%
zitadel · zitadelOct 29, 2025
CVE-2026-29192
30Monitor
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
HighCVSS 7.7No exploitEPSS 0%
- XSS
zitadel · zitadelMar 7, 2026
CVE-2024-28197
30Monitor
Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
zitadel · zitadelMar 11, 2024
CVE-2025-64717
29Monitor
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
HighCVSS 7.4No exploitEPSS 0%
- Auth bypass
zitadel · zitadelNov 13, 2025