Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

GO-2026-4751 vulnerabilities

Vulnerabilities for packages: zitadel...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: bank-vaults, rancher-security-scan, beats, jitsucom-bulker, gitlab-cng-fips, grafana-fips, neuvector-sigstore-interface-fips, gitlab-cng, k9s-fips, zitadel, kyverno, boring-registry-fips, grafana, istio-fips, beats-fips, mattermost-fips, ratify-fips, pluto-fips,...

SUSE CVE-2026-55669

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...

SUSE CVE-2026-55670

ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...

SUSE CVE-2026-55671

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

SUSE CVE-2026-55672

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refre...

CVE-2026-54693

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...

GHSA-JQ8W-8Q2F-FFM9 ZITADEL Users Can Self-Verify Email/Phone via API

Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While GHSA-282g-fhmx-xf54 CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API" closed the path that...

CVE-2026-54693

CVE-2026-54693 affects Zitadel versions 2.43.0–2.71.19, 3.0.0–3.4.11, and 4.0.0–4.15.1. The vulnerability exists in the self-management API paths (internal/command/user_v2_email.go, internal/command/user_v2_phone.go, internal/command/user_v2_human.go), where verification codes could be requested ...

GHSA-3FXJ-6JH8-HVHX vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

GHSA-9G5Q-2W5X-HMXF vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

GHSA-RJR7-JGGH-PGCP vulnerabilities

Vulnerabilities for packages: karma, zitadel, cosmo-router-fips, karma-fips, cosmo-router, telegraf, fluxcd-kustomize-mutating-webhook, fluxcd-kustomize-mutating-webhook-fips...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the auto-linking process by email, as the external identity provider does not verify ownership of the email address before linking accounts. An attacker can gain unauthorized access to a victim's local account...

CVE-2026-56666

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56665

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session....

CVE-2026-56668

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's...