663 matches found
zitadel
La infraestructura de identidad para des...
Zitadel - User Registration Bypass
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...
EUVD-2026-42966
ZITADEL: Auto-linking by email: IdP-side email verification is not checked...
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...
EUVD-2026-42963
ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider...
GO-2026-4751 vulnerabilities
Vulnerabilities for packages: zitadel...
GO-2026-5774 vulnerabilities
Vulnerabilities for packages: zitadel, telegraf, fluxcd-kustomize-mutating-webhook, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, cosmo-router, karma-fips, karma...
GO-2026-5775 vulnerabilities
Vulnerabilities for packages: zitadel, telegraf, fluxcd-kustomize-mutating-webhook, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, cosmo-router, karma-fips, karma...
GO-2026-5777 vulnerabilities
Vulnerabilities for packages: zitadel, telegraf, fluxcd-kustomize-mutating-webhook, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, cosmo-router, karma-fips, karma...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: kyverno, docker-compose-fips, pluto-fips, ratify-fips, istio-fips, beats-fips, kyverno-notation-aws-fips, neuvector-sigstore-interface-fips, grafana, mattermost-fips, jitsucom-bulker, zitadel, rancher-security-scan, k9s-fips, boring-registry-fips, tkn-fips,...
SUSE CVE-2026-55669
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...
SUSE CVE-2026-55670
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
SUSE CVE-2026-55671
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...
SUSE CVE-2026-55672
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refre...
CVE-2026-54693
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...
GHSA-JQ8W-8Q2F-FFM9 ZITADEL Users Can Self-Verify Email/Phone via API
Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While GHSA-282g-fhmx-xf54 CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API" closed the path that...
CVE-2026-54693
CVE-2026-54693 affects Zitadel versions 2.43.0–2.71.19, 3.0.0–3.4.11, and 4.0.0–4.15.1. The vulnerability exists in the self-management API paths (internal/command/user_v2_email.go, internal/command/user_v2_phone.go, internal/command/user_v2_human.go), where verification codes could be requested ...