Zitadel vulnerabilities
We track 46 vulnerabilities in Zitadel products. 46 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Zitadel vulnerabilities
- 7.5 High severity
zitadel: Improper Privilege Management
Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to
- 8.1 High severity
zitadel: Improper Restriction of Excessive Authentication Attempts
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password che
- 8.7 High severity
zitadel: Improper Neutralization of Input During Web Page Generation
ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to d
- 7.5 High severity
zitadel: Session Fixation
Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An att
- 8.8 High severity
zitadel: Weak Password Recovery Mechanism for Forgotten Password
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten an
- 8.8 High severity
zitadel: Incorrect Authorization
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the