Vulnerabilidades en zitadel

58 resultados
Análisis Vexday

Zitadel apresenta 57 vulnerabilidades catalogadas, com 3 críticas e nenhuma sob ataque ativo identificado. A fraqueza dominante é CWE-287 (falhas em autenticação), padrão esperado em solução de identidade, mas com 10 divulgações nos últimos 90 dias indicando ciclo ativo de descobertas que requerem monitoramento contínuo.

CVE-2026-29192HIGHZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverEPSS 0.3%CVE-2026-29193HIGHZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2EPSS 0.3%CVE-2026-33132MEDIUMZITADEL is missing enforcement of organization scopesEPSS 0.3%CVE-2025-67495HIGHZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginEPSS 0.3%CVE-2026-55670LOWZITADEL: Cross-Tenant User Leakage via Recycled IdentifiersEPSS 0.3%CVE-2025-64431HIGHIDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data TemperingEPSS 0.3%CVE-2026-55672HIGHZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)EPSS 0.3%CVE-2026-55671LOWZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP ComponentsEPSS 0.3%CVE-2026-56668HIGHZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeEPSS 0.2%CVE-2026-27945LOWZITADEL has potential SSRF via ActionsEPSS 0.2%CVE-2026-56667HIGHZITADEL: Stored XSS via Default URI Redirect in Login V2EPSS 0.2%CVE-2025-67717MEDIUMZitadel Discloses the Total Number of Instance UsersEPSS 0.2%CVE-2026-56664MEDIUMZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderEPSS 0.2%CVE-2026-56666MEDIUMZITADEL: Auto-linking by email: IdP-side email verification is not checkedEPSS 0.2%CVE-2026-27946HIGHZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIEPSS 0.2%CVE-2026-56665MEDIUMZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderEPSS 0.2%CVE-2026-27840MEDIUMZITADEL's truncated opaque tokens are still validEPSS 0.1%CVE-2026-55669MEDIUMZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderEPSS 0.1%