zitadel vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20235
3. 202414
4. 202515
5. 202643

Newest CVEs

• CVE-2026-119129

  ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

  zitadel · zitadel

  High8.6
• CVE-2026-119128

  ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

  zitadel · zitadel

  Critical9.1
• CVE-2026-119127

  ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

  zitadel · zitadel

  High8.6
• CVE-2026-109374

  ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

  zitadel · zitadel

  Medium5.1
• CVE-2026-109373

  ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

  zitadel · zitadel

  Critical9.2
• CVE-2026-109372

  ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

  zitadel · zitadel

  Critical9.3
• CVE-2026-109371

  ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

  zitadel · zitadel

  High8.8
• CVE-2026-105215

  ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

  zitadel · zitadel

  Critical9.3
• CVE-2026-105214

  Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

  zitadel · zitadel

  Low2.3
• CVE-2026-105213

  ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

  zitadel · zitadel

  High8.8