GHSA-Q5QJ-X2H5-3945 Zitadel exposing internal database user name and host information

Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. Patches 2.x versions are fixed on = 2.50.3 2.49.x versions are fixed on = 2.49.5 2.48.x versions are fixed on = 2.48.5 2.47.x versions are...

Zitadel exposing internal database user name and host information

Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. Patches 2.x versions are fixed on = 2.50.3 2.49.x versions are fixed on = 2.49.5 2.48.x versions are fixed on = 2.48.5 2.47.x versions are...

CVE-2024-32967

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967

The CVE-2024-32967 vulnerability affects Zitadel: when the system cannot connect to the database, it may leak sensitive connection details (database name, username, host) to the user. This has been addressed in all supported release branches via point releases; upgrading to the patched versions i...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. A security vulnerability exists in Zitadel that stems from the fact that Zitadel discloses internal database...

Improper Restriction Of Excessive Authentication Attempts

github.com/zitadel/zitadel/ is vulnerable to Improper Restriction of Excessive Authentication Attempts. The vulnerability is due to the absence of a mechanism to restrict failed TOTP authentication attempts...

CVE-2024-32868

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

CVE-2024-32868

CVE-2024-32868 affects ZITADEL and describes an improper lockout mechanism for MFA: there was no limit on (T)OTP verification attempts, enabling potential MFA bypass. The issue is fixed in version 2.50.0. Impact details in the connected sources indicate the lockout gap relates to TOTP/OTP checks,...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

GHSA-7J7J-66CV-M239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. A security vulnerability exists in ZITADEL versions prior to 2.50.0 that stems from an improper application locking...

Unrestricted Upload Of File With Dangerous Type

ZITADEL is vulnerable to Unrestricted Upload of File with Dangerous Type. The vulnerability is caused by bypassing the ContentTypeAllowed function in asset.go with a malicious avatar image upload. Files with MIME types not intended for use as avatar images are allowed. To be vulnerable, a differe...

Incorrect Authorization

ZITADEL is vulnerable to Incorrect Authorization. The vulnerability is due to certain actions being able to set reserved claims managed by ZITADEL, such as urn:zitadel:iam:user:resourceowner:name. To address this, a protection mechanism has been introduced to prevent actions from altering claims...

ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

Impact ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed imag...