Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

zitadel Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-85056`ZITADEL: MFA bypass via session reuse in Login V2	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published09/24/2026	SeverityHigh
`CVE-2026-85057`ZITADEL: Actions V1 sandbox escape: host file read via require()	Exploitation statusNot confirmed	FixYes	Affected productzitadel	Published09/24/2026	SeverityHigh
`CVE-2026-76081`ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published09/14/2026	SeverityMedium
`CVE-2026-54693`ZITADEL Users Can Self-Verify Email/Phone via API	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/29/2026	SeverityHigh
`CVE-2026-56668`ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityHigh
`CVE-2026-56666`ZITADEL: Auto-linking by email: IdP-side email verification is not checked	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityMedium
`CVE-2026-56667`ZITADEL: Stored XSS via Default URI Redirect in Login V2	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityHigh
`CVE-2026-56665`ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityMedium
`CVE-2026-56664`ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityMedium
`CVE-2026-55672`ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityHigh
`CVE-2026-55671`ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityLow
`CVE-2026-55670`ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityLow
`CVE-2026-55669`ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/10/2026	SeverityMedium
`CVE-2026-44671`ZITADEL: LDAP Filter Injection in Login Flow	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published05/14/2026	SeverityHigh
`CVE-2026-33132`ZITADEL is missing enforcement of organization scopes	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/20/2026	SeverityMedium
`CVE-2026-32132`ZITADEL: Reactivation of Expired Passkey Registration Codes	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/11/2026	SeverityHigh
`CVE-2026-32131`ZITADEL Cross-Tenant Information Disclosure in Management API	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/11/2026	SeverityHigh
`CVE-2026-32130`ZITADEL SCIM Authentication Bypass via URL Encoding	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/11/2026	SeverityHigh
`CVE-2026-29067`ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/07/2026	SeverityHigh
`CVE-2026-29193`ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/07/2026	SeverityHigh
`CVE-2026-29192`ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/07/2026	SeverityHigh
`CVE-2026-29191`ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/07/2026	SeverityCritical
`CVE-2026-27946`ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published02/26/2026	SeverityHigh
`CVE-2026-27945`ZITADEL has potential SSRF via Actions	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published02/26/2026	SeverityLow
`CVE-2026-27840`ZITADEL's truncated opaque tokens are still valid	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published02/26/2026	SeverityMedium
`CVE-2026-23511`ZITADEL has a user enumeration vulnerability in Login UIs	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published01/15/2026	SeverityMedium
`CVE-2025-67717`Zitadel Discloses the Total Number of Instance Users	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published12/11/2025	SeverityMedium
`CVE-2025-67495`ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published12/09/2025	SeverityHigh
`CVE-2025-67494`ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published12/09/2025	SeverityCritical
`CVE-2025-64717`ZITADEL vulnerable to Account Takeover with deactivated Instance IdP	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published11/13/2025	SeverityHigh
`CVE-2025-64431`IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published11/07/2025	SeverityHigh
`CVE-2025-64103`Zitadel Bypass Second Authentication Factor	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published10/29/2025	SeverityHigh
`CVE-2025-64102`Zitadel allows brute-forcing authentication factors	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published10/29/2025	SeverityHigh
`CVE-2025-64101`ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published10/29/2025	SeverityHigh
`CVE-2025-57770`ZITADEL user enumeration vulnerability in login UI	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published08/22/2025	SeverityMedium
`CVE-2025-53895`ZITADEL has broken authN and authZ in session API and resulting session tokens	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published07/15/2025	SeverityHigh
`CVE-2025-48936`ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published05/30/2025	SeverityHigh
`CVE-2025-46815`ZITADEL Allows IdP Intent Token Reuse	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published05/06/2025	SeverityHigh
`CVE-2025-31124`Zitadel allows User Enumeration by loginname attribute normalization	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/31/2025	SeverityMedium
`CVE-2025-31123`Zitadel Expired JWT Keys Usable for Authorization Grants	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/31/2025	SeverityHigh
`CVE-2025-27507`IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/04/2025	SeverityCritical
`CVE-2024-49757`Zitadel User Registration Bypass Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published10/25/2024	SeverityHigh
`CVE-2024-49753`Denied Host Validation Bypass in Zitadel Actions	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published10/25/2024	SeverityMedium
`CVE-2024-46999`User Grant Deactivation not Working in Zitadel	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published09/19/2024	SeverityHigh
`CVE-2024-47000`Service Users Deactivation not Working in Zitadel	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published09/19/2024	SeverityHigh
`CVE-2024-47060`Unauthorized Access After Organization or Project Deactivation in Zitadel	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published09/19/2024	SeverityMedium
`CVE-2024-41953`Zitadel improperly sanitizes HTML in emails and Console UI	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/31/2024	SeverityMedium
`CVE-2024-41952`Zitadel has an "Ignoring unknown usernames" vulnerability	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published07/31/2024	SeverityMedium
`CVE-2024-39683`ZITADEL Vulnerable to Session Information Leakage	Exploitation statusPublic exploit	FixNot confirmed	Affected productzitadel	Published07/03/2024	SeverityMedium
`CVE-2024-32967`Zitadel exposes internal database user name and host information	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published05/01/2024	SeverityMedium
`CVE-2024-32868`ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published04/25/2024	SeverityMedium
`CVE-2024-29892`ZITADEL's actions can overload reserved claims	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/27/2024	SeverityMedium
`CVE-2024-29891`ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published03/27/2024	SeverityHigh
`CVE-2024-28855`ZITADEL vulnerable to improper HTML sanitization	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published03/18/2024	SeverityHigh
`CVE-2024-28197`Account Takeover via Session Fixation in Zitadel [Bypassing MFA]	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published03/11/2024	SeverityHigh
`CVE-2023-49097`ZITADEL vulnerable account takeover via malicious host header injection	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published11/30/2023	SeverityHigh
`CVE-2023-47111`ZITADEL race condition in lockout policy execution	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published11/08/2023	SeverityHigh
`CVE-2023-46238`XSS with User Avatar image in ZITADEL	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published10/26/2023	SeverityHigh
`CVE-2023-44399`ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published10/10/2023	SeverityMedium
`CVE-2023-22492`RefreshToken invalidation vulnerability	Exploitation statusNot known exploited	FixYes	Affected productzitadel	Published01/11/2023	SeverityMedium
`CVE-2022-36051`Broken Authorization in ZITADEL Actions	Exploitation statusNot known exploited	FixNot confirmed	Affected productzitadel	Published08/31/2022	SeverityHigh

61 / 61 Results

All vulnerabilities loaded

Security vulnerabilities from zitadel

zitadel

How many security vulnerabilities does zitadel have?

Which zitadel product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular zitadel products

zitadel