CVE-2026-44671

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

CVE-2026-44671

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

CVE-2026-44671 ZITADEL: LDAP Filter Injection in Login Flow

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

EUVD-2026-30492

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

CVE-2026-44671 ZITADEL: LDAP Filter Injection in Login Flow

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

CVE-2026-44671

Summary of CVE-2026-44671 (ZITADEL LDAP Filter Injection) : Zitadel’s LDAP IdP parsing fails to escape user-provided usernames in LDAP search filters, enabling unauthenticated users to perform blind LDAP Injection during login. The issue affects Zitadel deployments using LDAP IdP in the following...

CVE-2026-44671 ZITADEL: LDAP Filter Injection in Login Flow

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allo...

ZITADEL 注入漏洞

ZITADEL is an open-source identity and access management platform developed by ZITADEL in Switzerland. Versions of ZITADEL from 2.71.11 up to 3.4.10, as well as version 4.15.0, had a vulnerability related to injection attacks. This vulnerability stemmed from improper escaping of user-provided...

ZITADEL has LDAP Filter Injection in Login Flow

Summary A vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process...

GHSA-RXVX-HHPJ-Q6PX ZITADEL has LDAP Filter Injection in Login Flow

Summary A vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process...

PT-2026-39289

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.71.11 through 2.71.19 ZITADEL versions 3.1.0 through 3.4.9 ZITADEL versions 4.0.0 through 4.14.0 Description An issue exists in the LDAP identity provider implementation where user-provided usernames are not properly escaped...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: certificate-transparency, spire-server, kubeflow-pipelines, kine, seaweedfs-rocksdb, caddy, step-issuer, teleport, sqlexporter-fips, gitaly-fips, sftpgo, vault-fips, step-ca-fips, bento-fips, commercial-grafana, envoy-gateway-fips, opentelemetry-collector-contrib,...

CVE-2026-27945 vulnerabilities

Vulnerabilities for packages: zitadel...

GHSA-7777-FHQ9-592V vulnerabilities

Vulnerabilities for packages: zitadel...

Improper Authentication

github.com/zitadel/zitadel is vulnerable to improper authentication. The vulnerability is due to MFA being enforced only when explicitly required by policy, which allows an attacker to bypass additional authentication factors and exploit weaker single-factor sessions, potentially compromising...

GHSA-G2PF-WW5M-2R9M vulnerabilities

Vulnerabilities for packages: zitadel...

CVE-2026-33132 vulnerabilities

Vulnerabilities for packages: zitadel...

DOM-Based Cross-Site Scripting (XSS)

github.com/zitadel/zitadel, is vulnerable to DOM-Based Cross-Site Scripting XSS. The vulnerability is due to improper validation of the postlogoutredirect parameter in the /logout endpoint, which allows an unauthenticated remote attacker to execute malicious JavaScript in users’ browsers...

SUSE CVE-2026-33132

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes urn:zitadel:iam:org:id:...

CVE-2026-32132

ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow ...