# zitadel.

Every CVE that names zitadel among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval](https://agentprime.io/advisories/CVE-2026-119129.md)
  `CVE-2026-119129` · CVE record: zitadel zitadel · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie](https://agentprime.io/advisories/CVE-2026-119128.md)
  `CVE-2026-119128` · CVE record: zitadel zitadel · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-565
- [ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection](https://agentprime.io/advisories/CVE-2026-119127.md)
  `CVE-2026-119127` · CVE record: zitadel zitadel · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-640
- [ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation](https://agentprime.io/advisories/CVE-2026-109374.md)
  `CVE-2026-109374` · CVE record: zitadel zitadel · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie](https://agentprime.io/advisories/CVE-2026-109373.md)
  `CVE-2026-109373` · CVE record: zitadel zitadel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-441
- [ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion](https://agentprime.io/advisories/CVE-2026-109372.md)
  `CVE-2026-109372` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1](https://agentprime.io/advisories/CVE-2026-109371.md)
  `CVE-2026-109371` · CVE record: zitadel zitadel · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback](https://agentprime.io/advisories/CVE-2026-105215.md)
  `CVE-2026-105215` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification](https://agentprime.io/advisories/CVE-2026-105214.md)
  `CVE-2026-105214` · CVE record: zitadel zitadel · CVSS 2.3 Low · Not analysed yet · Published 4 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations](https://agentprime.io/advisories/CVE-2026-105213.md)
  `CVE-2026-105213` · CVE record: zitadel zitadel · CVSS 8.8 High · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment](https://agentprime.io/advisories/CVE-2026-105212.md)
  `CVE-2026-105212` · CVE record: zitadel zitadel · CVSS 8.7 High · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode](https://agentprime.io/advisories/CVE-2026-105211.md)
  `CVE-2026-105211` · CVE record: zitadel zitadel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure
- [ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers](https://agentprime.io/advisories/CVE-2026-105210.md)
  `CVE-2026-105210` · CVE record: zitadel zitadel · CVSS 8.8 High · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment](https://agentprime.io/advisories/CVE-2026-105209.md)
  `CVE-2026-105209` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens](https://agentprime.io/advisories/CVE-2026-105208.md)
  `CVE-2026-105208` · CVE record: zitadel zitadel · CVSS 8.7 High · Not analysed yet · Published 4 Oct 2026 · Tags: CWE-649
- [ZITADEL before 4.17.3 Account Takeover via External IdP Linking](https://agentprime.io/advisories/CVE-2026-105207.md)
  `CVE-2026-105207` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service](https://agentprime.io/advisories/CVE-2026-105206.md)
  `CVE-2026-105206` · CVE record: zitadel zitadel · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [ZITADEL: Stored XSS via Default URI Redirect in Login V2](https://agentprime.io/advisories/CVE-2026-56667.md)
  `CVE-2026-56667` · CVE record: zitadel zitadel · CVSS 7.3 High · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS)
- [ZITADEL: Reactivation of Expired Passkey Registration Codes](https://agentprime.io/advisories/CVE-2026-32132.md)
  `CVE-2026-32132` · CVE record: zitadel zitadel · CVSS 7.4 High · Not analysed yet · Published 11 Mar 2026 · Tags: Authentication bypass
- [ZITADEL Cross-Tenant Information Disclosure in Management API](https://agentprime.io/advisories/CVE-2026-32131.md)
  `CVE-2026-32131` · CVE record: zitadel zitadel · CVSS 7.7 High · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control
- [ZITADEL SCIM Authentication Bypass via URL Encoding](https://agentprime.io/advisories/CVE-2026-32130.md)
  `CVE-2026-32130` · CVE record: zitadel zitadel · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Authentication bypass
- [ZITADEL user enumeration vulnerability in login UI](https://agentprime.io/advisories/CVE-2025-57770.md)
  `CVE-2025-57770` · CVE record: zitadel zitadel · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Information disclosure
- [ZITADEL has broken authN and authZ in session API and resulting session tokens](https://agentprime.io/advisories/CVE-2025-53895.md)
  `CVE-2025-53895` · CVE record: zitadel zitadel · CVSS 7.7 High · Not analysed yet · Published 15 Jul 2025 · Tags: Authentication bypass, Broken access control
- [Zitadel allows User Enumeration by loginname attribute normalization](https://agentprime.io/advisories/CVE-2025-31124.md)
  `CVE-2025-31124` · CVE record: zitadel zitadel · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Information disclosure, CWE-204
- [Zitadel Expired JWT Keys Usable for Authorization Grants](https://agentprime.io/advisories/CVE-2025-31123.md)
  `CVE-2025-31123` · CVE record: zitadel zitadel · CVSS 8.7 High · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-324
- [XSS with User Avatar image in ZITADEL](https://agentprime.io/advisories/CVE-2023-46238.md)
  `CVE-2023-46238` · CVE record: zitadel zitadel · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2023 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zitadel>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zitadel/>. Everything for agents: <https://agentprime.io/llms.txt>.