33 matches found
CVE-2026-15985
The Classified Listing – Mobile Number Verification WordPress plugin is vulnerable to unauthenticated authentication bypass in all versions up to and including 1.6.0 . The root cause is missing server-side Firebase OTP validation in the process_otp_login() function, allowing an attacker to authen...
anti-anti-automation
Anti-Anti-Automation Framework Ein Framework für Techniken zur Umgehung gängiger Sicherheitskontrollen gegen Automatisierung. Häufige Anti-Automatisierungs-Kontrollen E-Mail-Verifizierung CAPTCHA SMS/Telefon Kreditkarte WASC-21: Unzureichende Anti-Automatisierung...
GHSA-JQ8W-8Q2F-FFM9 ZITADEL Users Can Self-Verify Email/Phone via API
Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While GHSA-282g-fhmx-xf54 CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API" closed the path that...
CVE-2026-54693
CVE-2026-54693 affects Zitadel versions 2.43.0–2.71.19, 3.0.0–3.4.11, and 4.0.0–4.15.1. The vulnerability exists in the self-management API paths (internal/command/user_v2_email.go, internal/command/user_v2_phone.go, internal/command/user_v2_human.go), where verification codes could be requested ...
CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...
instagrapi: Unsafe signup challenge path handling in instagrapi
instagrapi versions before 2.6.9 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intende...
SUSE CVE-2026-27946
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. Impact Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updati...
GHSA-282G-FHMX-XF54 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. Impact Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updati...
CVE-2026-27946
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the UpdateHumanUser API. An attacker can bypass proper verification of email or phone by directly setting the verification flag without completing the intended verification process. This may allow unauthorized...
CVE-2026-27946
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
CVE-2026-27946
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
CVE-2026-27946
ZITADEL exposes a vulnerability in its self-management capability prior to versions 4.11.1 and 3.4.7 that allowed a user to mark their email and/or phone as verified without going through actual verification. The fix, in versions 4.11.1 and 3.4.7, enforces the correct permission when the verifica...
CVE-2026-27946 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
CVE-2026-27946 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
CVE-2026-27946 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...
PT-2026-22071
Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.7 ZITADEL versions prior to 4.11.1 Description ZITADEL, an open source identity management platform, had a flaw in its self-management feature. This allowed users to falsely mark their email and phone as verified...
