Vulnerabilidades em zitadel

78 resultados
Análise Vexday

Zitadel apresenta 57 vulnerabilidades catalogadas, com 3 críticas e nenhuma sob ataque ativo identificado. A fraqueza dominante é CWE-287 (falhas em autenticação), padrão esperado em solução de identidade, mas com 10 divulgações nos últimos 90 dias indicando ciclo ativo de descobertas que requerem monitoramento contínuo.

CVE-2026-29067HIGHZITADEL: Account Takeover Due to Improper Instance Validation in V2 LoginEPSS 0.4%CVE-2026-109372CRITICALZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionEPSS 0.4%CVE-2025-64102HIGHZitadel allows brute-forcing authentication factorsEPSS 0.4%CVE-2025-64101HIGHZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionEPSS 0.4%CVE-2026-109371HIGHZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1EPSS 0.4%CVE-2026-55670LOWZITADEL: Cross-Tenant User Leakage via Recycled IdentifiersEPSS 0.4%CVE-2024-47060MEDIUMUnauthorized Access After Organization or Project Deactivation in ZitadelEPSS 0.4%CVE-2026-29193HIGHZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2EPSS 0.4%CVE-2024-46999HIGHUser Grant Deactivation not Working in ZitadelEPSS 0.4%CVE-2025-64103HIGHZitadel Bypass Second Authentication FactorEPSS 0.4%CVE-2026-29192HIGHZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverEPSS 0.4%CVE-2026-105215CRITICALZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP CallbackEPSS 0.3%CVE-2024-28197HIGHAccount Takeover via Session Fixation in Zitadel [Bypassing MFA]EPSS 0.3%CVE-2026-105211CRITICALZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodeEPSS 0.3%CVE-2026-33132MEDIUMZITADEL is missing enforcement of organization scopesEPSS 0.3%CVE-2026-105212HIGHZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey EnrollmentEPSS 0.3%CVE-2026-56664MEDIUMZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderEPSS 0.3%CVE-2026-105207CRITICALZITADEL before 4.17.3 Account Takeover via External IdP LinkingEPSS 0.3%CVE-2025-64431HIGHIDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data TemperingEPSS 0.3%CVE-2025-67495HIGHZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginEPSS 0.3%