1118570 matches found
Exploit for Improper Authentication in Fortinet Fortiproxy
CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Aut...
metasploitable2-privilege-escalation
Task 05 — Privilege Escalation Zyroo Cybersecurity Internsh...
Exploit for Improper Validation of Consistency within Input in Linux Linux_Kernel
copyfail-check !CIhttps://github.com/ledlight33/copyfail-...
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...
CVE-2026-105206
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...
PoC-Deployer-System
PoC-Deployer-System !License: MIThttps://img.shields.io/b...
Exploit for CVE-2026-104991
CVE-2026-104991 — Missing Authorization BOLA/IDOR in Phproje...
CVE-2026-105212
ZITADEL versions prior to 3.4.14 and 4.16.2 are vulnerable to an authentication bypass in the hosted Login V1 and Login V2 UIs. The root cause is the system's acceptance of passkey or other authenticator enrollments during identify-only login sessions before a primary factor is verified. This all...
EUVD-2026-92105
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...
CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...
CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...
EUVD-2026-92102
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...
CVE-2026-105209
ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to an improper authorization flaw (CWE-862) during passkey or passwordless enrollment. The system incorrectly validates the organization ID provided in the x-zitadel-orgid header instead of verifying the target user's actual ...
CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...
EUVD-2026-92100
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...
CVE-2026-105207
ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 are vulnerable to an account takeover due to improper verification when linking external identity providers. The User Service V2 AddIDPLink endpoint and identify-only Login V2 sessions fail to verify a primary factor or the caller's pe...
CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...
CVE-2026-105206
ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 are vulnerable to an incorrect authorization flaw in the User Service API . The vulnerability exists because the system verifies the user.read permission against the caller's organization rather than the organization that owns the target...