agentprime: zitadelEvery new CVE for zitadel.https://agentprime.io/CVE-2026-119129: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approvalhttps://agentprime.io/advisories/CVE-2026-119129/https://agentprime.io/advisories/CVE-2026-119129/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:11 GMTCVECVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookiehttps://agentprime.io/advisories/CVE-2026-119128/https://agentprime.io/advisories/CVE-2026-119128/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:10 GMTCVEcriticalCVE-2026-119127: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injectionhttps://agentprime.io/advisories/CVE-2026-119127/https://agentprime.io/advisories/CVE-2026-119127/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:09 GMTCVECVE-2026-109374: ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonationhttps://agentprime.io/advisories/CVE-2026-109374/https://agentprime.io/advisories/CVE-2026-109374/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:46 GMTCVECVE-2026-109373: ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookiehttps://agentprime.io/advisories/CVE-2026-109373/https://agentprime.io/advisories/CVE-2026-109373/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:45 GMTCVEcriticalCVE-2026-109372: ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusionhttps://agentprime.io/advisories/CVE-2026-109372/https://agentprime.io/advisories/CVE-2026-109372/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:44 GMTCVEcriticalCVE-2026-109371: ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1https://agentprime.io/advisories/CVE-2026-109371/https://agentprime.io/advisories/CVE-2026-109371/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:44 GMTCVECVE-2026-105215: ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callbackhttps://agentprime.io/advisories/CVE-2026-105215/https://agentprime.io/advisories/CVE-2026-105215/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:07 GMTCVEcriticalCVE-2026-105214: Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verificationhttps://agentprime.io/advisories/CVE-2026-105214/https://agentprime.io/advisories/CVE-2026-105214/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:06 GMTCVECVE-2026-105213: ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizationshttps://agentprime.io/advisories/CVE-2026-105213/https://agentprime.io/advisories/CVE-2026-105213/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:05 GMTCVECVE-2026-105212: ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollmenthttps://agentprime.io/advisories/CVE-2026-105212/https://agentprime.io/advisories/CVE-2026-105212/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:05 GMTCVECVE-2026-105211: ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodehttps://agentprime.io/advisories/CVE-2026-105211/https://agentprime.io/advisories/CVE-2026-105211/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:04 GMTCVEcriticalCVE-2026-105210: ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlershttps://agentprime.io/advisories/CVE-2026-105210/https://agentprime.io/advisories/CVE-2026-105210/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:03 GMTCVECVE-2026-105209: ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmenthttps://agentprime.io/advisories/CVE-2026-105209/https://agentprime.io/advisories/CVE-2026-105209/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:03 GMTCVEcriticalCVE-2026-105208: ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokenshttps://agentprime.io/advisories/CVE-2026-105208/https://agentprime.io/advisories/CVE-2026-105208/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:02 GMTCVECVE-2026-105207: ZITADEL before 4.17.3 Account Takeover via External IdP Linkinghttps://agentprime.io/advisories/CVE-2026-105207/https://agentprime.io/advisories/CVE-2026-105207/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:02 GMTCVEcriticalCVE-2026-105206: ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Servicehttps://agentprime.io/advisories/CVE-2026-105206/https://agentprime.io/advisories/CVE-2026-105206/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 04 Oct 2026 13:10:01 GMTCVECVE-2026-56667: ZITADEL: Stored XSS via Default URI Redirect in Login V2https://agentprime.io/advisories/CVE-2026-56667/https://agentprime.io/advisories/CVE-2026-56667/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 17:25:46 GMTCVECVE-2026-32132: ZITADEL: Reactivation of Expired Passkey Registration Codeshttps://agentprime.io/advisories/CVE-2026-32132/https://agentprime.io/advisories/CVE-2026-32132/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 21:40:07 GMTCVECVE-2026-32131: ZITADEL Cross-Tenant Information Disclosure in Management APIhttps://agentprime.io/advisories/CVE-2026-32131/https://agentprime.io/advisories/CVE-2026-32131/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 21:38:51 GMTCVECVE-2026-32130: ZITADEL SCIM Authentication Bypass via URL Encodinghttps://agentprime.io/advisories/CVE-2026-32130/https://agentprime.io/advisories/CVE-2026-32130/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 21:37:07 GMTCVECVE-2025-57770: ZITADEL user enumeration vulnerability in login UIhttps://agentprime.io/advisories/CVE-2025-57770/https://agentprime.io/advisories/CVE-2025-57770/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 Aug 2025 16:50:35 GMTCVECVE-2025-53895: ZITADEL has broken authN and authZ in session API and resulting session tokenshttps://agentprime.io/advisories/CVE-2025-53895/https://agentprime.io/advisories/CVE-2025-53895/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Jul 2025 16:39:00 GMTCVECVE-2025-31124: Zitadel allows User Enumeration by loginname attribute normalizationhttps://agentprime.io/advisories/CVE-2025-31124/https://agentprime.io/advisories/CVE-2025-31124/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Mar 2025 19:38:12 GMTCVECVE-2025-31123: Zitadel Expired JWT Keys Usable for Authorization Grantshttps://agentprime.io/advisories/CVE-2025-31123/https://agentprime.io/advisories/CVE-2025-31123/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Mar 2025 19:31:40 GMTCVECVE-2023-46238: XSS with User Avatar image in ZITADELhttps://agentprime.io/advisories/CVE-2023-46238/https://agentprime.io/advisories/CVE-2023-46238/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Oct 2023 14:22:52 GMTCVE