CVE-2023-47111

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

Default credentials

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

CVE-2023-47111 ZITADEL race condition in lockout policy execution

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

CVE-2023-47111 ZITADEL race condition in lockout policy execution

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

CVE-2023-47111 ZITADEL race condition in lockout policy execution

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

CVE-2023-47111

CVE-2023-47111 describes a race condition in ZITADEL’s lockout policy: an attacker could initiate multiple parallel password checks, enabling more attempts than the policy allows. The issue affects ZITADEL’s identity infrastructure and relates to the handling of failed password checks within the ...

GHSA-7H8M-VRXX-VR4M ZITADEL race condition in lockout policy execution

Impact ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent...

ZITADEL race condition in lockout policy execution

Impact ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent...

CVE-2023-47111: Concurrent Execution using Shared Resource with Improper Synchronization

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...

ZITADEL Competitive conditions loophole

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL Switzerland. ZITADEL versions prior to 2.40.5, 2.38.3 and prior to 2.38.3 suffer from a Competing Conditions Issue vulnerability that...

Cross-Site Scripting (XSS)

github.com/zitadel/zitadel is vulnerable to Cross-Site Scripting. This vulnerability exists due to a missing security header in asset.go, allowing an attacker to inject and execute malicious JavaScript in the victim's browser via a crafted SVG image...

CVE-2023-46238

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

CVE-2023-46238 XSS with User Avatar image in ZITADEL

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

CVE-2023-46238

ZITADEL’s CVE-2023-46238 vulnerability affects the Avatar SVG upload feature. An attacker can exploit SVGs containing scripts due to a missing security header, potentially gaining access to a victim’s account when the SVG is opened in the browser during a active session. Impact is described as re...

CVE-2023-46238 XSS with User Avatar image in ZITADEL

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

CVE-2023-46238 XSS with User Avatar image in ZITADEL

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

ZITADEL Security Vulnerabilities

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from allowing an attacker to inject code into an SVG file to...

CVE-2023-46238: Improper Neutralization of Input During Web Page Generation

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to...

PT-2023-29921 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 2.38.2 ZITADEL versions prior to 2.39.2 Description: ZITADEL is an identity infrastructure management system where users can upload their own avatar image using various image types, including SVG. SVG can include...

Information Disclosure

github.com/zitadel/zitadel is vulnerable to Information Disclosure. This vulnerability allows an attacker to verify if an account exists in ZITADEL by using the password reset function, even if the Ignoring unknown usernames setting is enabled...