Vulnerabilidades en zitadel
78 resultadosCVE-2026-85056HIGHZITADEL: MFA bypass via session reuse in Login V2EPSS 0.3%CVE-2026-119128CRITICALZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck CookieEPSS 0.3%CVE-2026-56666MEDIUMZITADEL: Auto-linking by email: IdP-side email verification is not checkedEPSS 0.3%CVE-2026-119129HIGHZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization ApprovalEPSS 0.3%CVE-2026-105206MEDIUMZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User ServiceEPSS 0.3%CVE-2026-119127HIGHZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header InjectionEPSS 0.3%CVE-2026-56665MEDIUMZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderEPSS 0.3%CVE-2026-27945LOWZITADEL has potential SSRF via ActionsEPSS 0.3%CVE-2026-105210HIGHZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init HandlersEPSS 0.2%CVE-2026-105213HIGHZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated OrganizationsEPSS 0.2%CVE-2025-67717MEDIUMZitadel Discloses the Total Number of Instance UsersEPSS 0.2%CVE-2026-105209CRITICALZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey EnrollmentEPSS 0.2%CVE-2026-27946HIGHZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIEPSS 0.2%CVE-2026-105214LOWZitadel before 4.16.2 SSRF via Organization Domain HTTP VerificationEPSS 0.2%CVE-2026-109374MEDIUMZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange ImpersonationEPSS 0.2%CVE-2026-27840MEDIUMZITADEL's truncated opaque tokens are still validEPSS 0.2%CVE-2026-55669MEDIUMZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderEPSS 0.2%CVE-2026-105208HIGHZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent TokensEPSS 0.1%