ZITADEL Vulnerable to Session Information Leakage

Impact ZITADEL provides users the ability to list all user sessions of the current user agent browser by API and in the Console UI. Due to a missing check, user sessions without that information e.g. when created though the session service were incorrectly listed exposing potentially other user's...

Sensitive Information Disclosure

ZITADEL is vulnerable to Sensitive Information Disclosure. The vulnerability is due to a missing check that incorrectly lists user sessions without specific information, potentially exposing other users' sessions...

CVE-2024-39683

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

CVE-2024-39683 ZITADEL Vulnerable to Session Information Leakage

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

CVE-2024-39683

CVE-2024-39683 affects ZITADEL open-source identity infrastructure. A missing check allowed listing of user sessions across different users in the browser context, exposing potentially other users’ sessions. The issue occurs in versions starting from 2.53.0 and remains present in prior to fixed v...

CVE-2024-39683 ZITADEL Vulnerable to Session Information Leakage

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

CVE-2024-39683 ZITADEL Vulnerable to Session Information Leakage

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent browser. Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information e.g...

PT-2024-28623 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions 2.0.0 through 2.53.7 ZITADEL versions 2.54.0 through 2.54.4 ZITADEL versions 2.55.0 through 2.55.0 Description: ZITADEL is an open-source identity infrastructure tool that provides users the ability to list all user sessions ...

ZITADEL Security Vulnerabilities

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from the fact that due to a lack of checks, user sessions...

GO-2024-2637 Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

Account Takeover via Session Fixation in Zitadel Bypassing MFA in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2024-2665 ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-2788 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2024-2664 ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2024-2804 Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

Information Disclosure

github.com/zitadel/zitadel is vulnerable to an Information Disclosure. The vulnerability is due to inadequate error handling, which can allows expose sensitive database connection information to users during a connection failure...

GHSA-Q5QJ-X2H5-3945 Zitadel exposing internal database user name and host information

Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. Patches 2.x versions are fixed on = 2.50.3 2.49.x versions are fixed on = 2.49.5 2.48.x versions are fixed on = 2.48.5 2.47.x versions are...

Zitadel exposing internal database user name and host information

Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. Patches 2.x versions are fixed on = 2.50.3 2.49.x versions are fixed on = 2.49.5 2.48.x versions are fixed on = 2.48.5 2.47.x versions are...

CVE-2024-32967

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967

The CVE-2024-32967 vulnerability affects Zitadel: when the system cannot connect to the database, it may leak sensitive connection details (database name, username, host) to the user. This has been addressed in all supported release branches via point releases; upgrading to the patched versions i...