zitadel kayıtları
zitadel üreticisine ait 47 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %95,7
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5
- CWE-287 Improper Authentication4
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor4
- CWE-269 Improper Privilege Management3
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')3
- CWE-203 Observable Discrepancy2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
47 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
37İzleyin | CVE-2026-29191İstismar yok | ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpointzitadel · zitadel · CWE-79 | Kritik9,3 | — | %0,4 | 7 Mar 2026 |
37İzleyin | CVE-2026-29067İstismar yok | ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Loginzitadel · zitadel · CWE-601 | Kritik9,3 | — | %0,3 | 7 Mar 2026 |
36İzleyin | CVE-2024-49753İstismar yok | Denied Host Validation Bypass in Zitadel Actionszitadel · zitadel · CWE-20 | Kritik9,1 | — | %0,6 | 25 Eki 2024 |
36İzleyin | CVE-2025-27507İstismar yok | IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurationszitadel · zitadel · CWE-639 | Kritik9,0 | — | %0,6 | 4 Mar 2025 |
35İzleyin | CVE-2022-36051İstismar yok | Broken Authorization in ZITADEL Actionszitadel · zitadel · CWE-436 | Yüksek8,8 | — | %1,0 | 31 Ağu 2022 |
35İzleyin | CVE-2023-49097İstismar yok | ZITADEL vulnerable account takeover via malicious host header injectionzitadel · zitadel · CWE-640 | Yüksek8,8 | — | %0,7 | 30 Kas 2023 |
35İzleyin | CVE-2025-48936İstismar yok | ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injectionzitadel · zitadel · CWE-601 | Yüksek8,8 | — | %0,4 | 30 May 2025 |
35İzleyin | CVE-2025-64101İstismar yok | ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injectionzitadel · zitadel · CWE-601 | Yüksek8,8 | — | %0,3 | 29 Eki 2025 |
34İzleyin | CVE-2024-29891İstismar yok | ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypasszitadel · zitadel · CWE-434 | Yüksek8,7 | — | %0,7 | 27 Mar 2024 |
34İzleyin | CVE-2025-67494Kavram kanıtı | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel · zitadel · CWE-918 | Yüksek8,6 | — | %0,4 | 9 Ara 2025 |
34İzleyin | CVE-2025-31123İstismar yok | Zitadel Expired JWT Keys Usable for Authorization Grantszitadel · zitadel · CWE-324 | Yüksek8,7 | — | %0,4 | 31 Mar 2025 |
34İzleyin | CVE-2025-64103İstismar yok | Zitadel Bypass Second Authentication Factorzitadel · zitadel · CWE-287 | Yüksek8,7 | — | %0,3 | 29 Eki 2025 |
32İzleyin | CVE-2025-46815İstismar yok | ZITADEL Allows IdP Intent Token Reusezitadel · zitadel · CWE-294 | Yüksek8,0 | — | %0,4 | 6 May 2025 |
32İzleyin | CVE-2024-32868Kavram kanıtı | ZITADEL's Improper Lockout Mechanism Leads to MFA Bypasszitadel · zitadel · CWE-297 | Yüksek8,1 | — | %0,4 | 25 Nis 2024 |
32İzleyin | CVE-2026-29193İstismar yok | ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2zitadel · zitadel · CWE-287 | Yüksek8,2 | — | %0,3 | 7 Mar 2026 |
32İzleyin | CVE-2026-27946İstismar yok | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIzitadel · zitadel · CWE-862 | Yüksek8,2 | — | %0,2 | 25 Şub 2026 |
30İzleyin | CVE-2026-32130İstismar yok | ZITADEL SCIM Authentication Bypass via URL Encodingzitadel · zitadel · CWE-288 | Yüksek7,5 | — | %0,6 | 11 Mar 2026 |
30İzleyin | CVE-2026-44671İstismar yok | ZITADEL: LDAP Filter Injection in Login Flowzitadel · zitadel · CWE-90 | Yüksek7,5 | — | %0,4 | 14 May 2026 |
30İzleyin | CVE-2025-53895İstismar yok | ZITADEL has broken authN and authZ in session API and resulting session tokenszitadel · zitadel · CWE-384 | Yüksek7,7 | — | %0,4 | 15 Tem 2025 |
30İzleyin | CVE-2024-47000İstismar yok | Service Users Deactivation not Working in Zitadelzitadel · zitadel · CWE-269 | Yüksek7,5 | — | %0,4 | 19 Eyl 2024 |
30İzleyin | CVE-2026-32131İstismar yok | ZITADEL Cross-Tenant Information Disclosure in Management APIzitadel · zitadel · CWE-639 | Yüksek7,7 | — | %0,4 | 11 Mar 2026 |
30İzleyin | CVE-2025-64102İstismar yok | Zitadel allows brute-forcing authentication factorszitadel · zitadel · CWE-307 | Yüksek7,7 | — | %0,3 | 29 Eki 2025 |
30İzleyin | CVE-2024-28197İstismar yok | Account Takeover via Session Fixation in Zitadel [Bypassing MFA]zitadel · zitadel · CWE-269 | Yüksek7,5 | — | %0,3 | 11 Mar 2024 |
30İzleyin | CVE-2026-29192İstismar yok | ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeoverzitadel · zitadel · CWE-79 | Yüksek7,7 | — | %0,3 | 7 Mar 2026 |
29İzleyin | CVE-2025-64717İstismar yok | ZITADEL vulnerable to Account Takeover with deactivated Instance IdPzitadel · zitadel · CWE-287 | Yüksek7,4 | — | %0,4 | 13 Kas 2025 |
- CVE-2026-2919137İzleyin
ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
KritikCVSS 9,3İstismar yokEPSS %0zitadel · zitadel7 Mar 2026
- CVE-2026-2906737İzleyin
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
KritikCVSS 9,3İstismar yokEPSS %0zitadel · zitadel7 Mar 2026
- CVE-2024-4975336İzleyin
Denied Host Validation Bypass in Zitadel Actions
KritikCVSS 9,1İstismar yokEPSS %0zitadel · zitadel25 Eki 2024
- CVE-2025-2750736İzleyin
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
KritikCVSS 9,0İstismar yokEPSS %0zitadel · zitadel4 Mar 2025
- CVE-2022-3605135İzleyin
Broken Authorization in ZITADEL Actions
YüksekCVSS 8,8İstismar yokEPSS %1zitadel · zitadel31 Ağu 2022
- CVE-2023-4909735İzleyin
ZITADEL vulnerable account takeover via malicious host header injection
YüksekCVSS 8,8İstismar yokEPSS %0zitadel · zitadel30 Kas 2023
- CVE-2025-4893635İzleyin
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
YüksekCVSS 8,8İstismar yokEPSS %0zitadel · zitadel30 May 2025
- CVE-2025-6410135İzleyin
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
YüksekCVSS 8,8İstismar yokEPSS %0zitadel · zitadel29 Eki 2025
- CVE-2024-2989134İzleyin
ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
YüksekCVSS 8,7İstismar yokEPSS %0zitadel · zitadel27 Mar 2024
- CVE-2025-6749434İzleyin
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
YüksekCVSS 8,6Kavram kanıtıEPSS %0zitadel · zitadel9 Ara 2025
- CVE-2025-3112334İzleyin
Zitadel Expired JWT Keys Usable for Authorization Grants
YüksekCVSS 8,7İstismar yokEPSS %0zitadel · zitadel31 Mar 2025
- CVE-2025-6410334İzleyin
Zitadel Bypass Second Authentication Factor
YüksekCVSS 8,7İstismar yokEPSS %0zitadel · zitadel29 Eki 2025
- CVE-2025-4681532İzleyin
ZITADEL Allows IdP Intent Token Reuse
YüksekCVSS 8,0İstismar yokEPSS %0zitadel · zitadel6 May 2025
- CVE-2024-3286832İzleyin
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
YüksekCVSS 8,1Kavram kanıtıEPSS %0zitadel · zitadel25 Nis 2024
- CVE-2026-2919332İzleyin
ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2
YüksekCVSS 8,2İstismar yokEPSS %0zitadel · zitadel7 Mar 2026
- CVE-2026-2794632İzleyin
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
YüksekCVSS 8,2İstismar yokEPSS %0zitadel · zitadel25 Şub 2026
- CVE-2026-3213030İzleyin
ZITADEL SCIM Authentication Bypass via URL Encoding
YüksekCVSS 7,5İstismar yokEPSS %0zitadel · zitadel11 Mar 2026
- CVE-2026-4467130İzleyin
ZITADEL: LDAP Filter Injection in Login Flow
YüksekCVSS 7,5İstismar yokEPSS %0zitadel · zitadel14 May 2026
- CVE-2025-5389530İzleyin
ZITADEL has broken authN and authZ in session API and resulting session tokens
YüksekCVSS 7,7İstismar yokEPSS %0zitadel · zitadel15 Tem 2025
- CVE-2024-4700030İzleyin
Service Users Deactivation not Working in Zitadel
YüksekCVSS 7,5İstismar yokEPSS %0zitadel · zitadel19 Eyl 2024
- CVE-2026-3213130İzleyin
ZITADEL Cross-Tenant Information Disclosure in Management API
YüksekCVSS 7,7İstismar yokEPSS %0zitadel · zitadel11 Mar 2026
- CVE-2025-6410230İzleyin
Zitadel allows brute-forcing authentication factors
YüksekCVSS 7,7İstismar yokEPSS %0zitadel · zitadel29 Eki 2025
- CVE-2024-2819730İzleyin
Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
YüksekCVSS 7,5İstismar yokEPSS %0zitadel · zitadel11 Mar 2024
- CVE-2026-2919230İzleyin
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
YüksekCVSS 7,7İstismar yokEPSS %0zitadel · zitadel7 Mar 2026
- CVE-2025-6471729İzleyin
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
YüksekCVSS 7,4İstismar yokEPSS %0zitadel · zitadel13 Kas 2025