GO-2024-2664 ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

ZITADEL's actions can overload reserved claims

Impact Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name json "urn:zitadel:iam:user:resourceowner:name": "ACME" if it was not set by ZITADEL itself. To compensate for this w...

GHSA-GP8G-F42F-95Q2 ZITADEL's actions can overload reserved claims

Impact Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name json "urn:zitadel:iam:user:resourceowner:name": "ACME" if it was not set by ZITADEL itself. To compensate for this w...

CVE-2024-29892

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

CVE-2024-29892 ZITADEL's actions can overload reserved claims

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

CVE-2024-29892

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim "urn:zitadel:iam:user:resourceowner:name". To compensate for thi...

CVE-2024-29892 ZITADEL's actions can overload reserved claims

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

PT-2024-23115

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 2.42.17 ZITADEL versions 2.42.17 through 2.48.3 Description The issue arises from the use of Go templates to render the login UI in ZITADEL, allowing actions to set reserved claims under certain circumstances. For...