zitadel vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' sessCritical 9.2 · Oct 12, 2026
• CVE-2026-109372 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion sCritical 9.3 · Oct 12, 2026
• CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bouHigh 8.8 · Oct 12, 2026
• CVE-2026-105215 ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration enCritical 9.3 · Oct 4, 2026
• CVE-2026-105213 ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status.High 8.8 · Oct 4, 2026
• CVE-2026-105212 ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authentiHigh 8.7 · Oct 4, 2026
• CVE-2026-105211 ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP cCritical 9.2 · Oct 4, 2026
• CVE-2026-105210 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initializatHigh 8.8 · Oct 4, 2026
• CVE-2026-105209 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checCritical 9.3 · Oct 4, 2026
• CVE-2026-105208 ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper wHigh 8.7 · Oct 4, 2026
• CVE-2026-105207 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or tCritical 9.3 · Oct 4, 2026
• CVE-2026-85057 ZITADEL is an open source identity management platform.High 8.7 · Sep 24, 2026
• CVE-2026-85056 ZITADEL is an open source identity management platform.High 8.2 · Sep 24, 2026
• CVE-2026-54693 ZITADEL is an open source identity management platform.High 8.2 · Jul 29, 2026
• CVE-2026-56668 ZITADEL is an open source identity management platform.High 8.1 · Jul 10, 2026
• CVE-2026-56667 ZITADEL is an open source identity management platform.High 7.3 · Jul 10, 2026
• CVE-2026-55672 ZITADEL is an open source identity management platform.High 7.4 · Jul 10, 2026
• CVE-2026-44671 ZITADEL is an open source identity management platform.High 7.5 · May 14, 2026
• CVE-2026-32132 ZITADEL is an open source identity management platform.High 7.4 · Mar 11, 2026
• CVE-2026-32131 ZITADEL is an open source identity management platform.High 7.7 · Mar 11, 2026
• CVE-2026-32130 ZITADEL is an open source identity management platform.High 7.5 · Mar 11, 2026
• CVE-2026-29193 ZITADEL is an open source identity management platform.High 8.2 · Mar 7, 2026
• CVE-2026-29192 ZITADEL is an open source identity management platform.High 7.7 · Mar 7, 2026
• CVE-2026-29191 ZITADEL is an open source identity management platform.Critical 9.3 · Mar 7, 2026
• CVE-2026-29067 ZITADEL is an open source identity management platform.High 8.1 · Mar 7, 2026