Security Advisories for github.com/zitadel/zitadel in go
Moderate
about 2 months ago
ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
go
github.com/zitadel/zitadel
Moderate
about 2 months ago
ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
go
github.com/zitadel/zitadel
High
about 2 months ago
ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
go
github.com/zitadel/zitadel
Low
about 2 months ago
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
go
github.com/zitadel/zitadel
Low
about 2 months ago
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
go
github.com/zitadel/zitadel
Moderate
5 months ago
Zitadel is missing enforcement of organization scopes
go
github.com/zitadel/zitadel
High
5 months ago
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
go
github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2
High
5 months ago
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication
go
github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2
Critical
5 months ago
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint
go
github.com/zitadel/zitadel/v2, github.com/zitadel/zitadel
High
5 months ago
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
go
github.com/zitadel/zitadel
Moderate
5 months ago
ZITADEL's truncated opaque tokens are still valid
go
github.com/zitadel/zitadel
Moderate
7 months ago
Zitadel has a user enumeration vulnerability in Login UIs
go
github.com/zitadel/zitadel
Moderate
8 months ago
Zitadel Discloses the Total Number of Instance Users
go
github.com/zitadel/zitadel
High
8 months ago
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
go
github.com/zitadel/zitadel
High
8 months ago
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
go
github.com/zitadel/zitadel/v2, github.com/zitadel/zitadel
Critical
8 months ago
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
go
github.com/zitadel/zitadel/v2, github.com/zitadel/zitadel
High
9 months ago
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP
go
github.com/zitadel/zitadel
High
9 months ago
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
go
github.com/zitadel/zitadel
High
about 1 year ago
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
go
github.com/zitadel/zitadel/v2, github.com/zitadel/zitadel
Critical
over 1 year ago
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
go
github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2
Moderate
almost 2 years ago
Denied Host Validation Bypass in Zitadel Actions
go
github.com/zitadel/zitadel
Moderate
about 2 years ago
ZITADEL "ignoring unknown usernames" vulnerability
go
github.com/zitadel/zitadel
Moderate
about 2 years ago
ZITADEL has improper HTML sanitization in emails and Console UI
go
github.com/zitadel/zitadel
Moderate
about 2 years ago
ZITADEL Vulnerable to Session Information Leakage
go
github.com/zitadel/zitadel
Moderate
over 2 years ago
Zitadel exposing internal database user name and host information
go
github.com/zitadel/zitadel
High
over 2 years ago
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
go
github.com/zitadel/zitadel
High
over 2 years ago
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
go
github.com/zitadel/zitadel
High
over 2 years ago
Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
go
github.com/zitadel/zitadel
High
over 2 years ago
ZITADEL Account Takeover via Malicious Host Header Injection
go
github.com/zitadel/zitadel
High
over 2 years ago
ZITADEL race condition in lockout policy execution
go
github.com/zitadel/zitadel
Moderate
almost 3 years ago
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
go
github.com/zitadel/zitadel
Moderate
over 3 years ago
Zitadel RefreshToken invalidation vulnerability
go
github.com/zitadel/zitadel