CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,432 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,432
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product zitadel:zitadel. Show all products

37 CVEs, showing 1 to 37
CVESeverityTitlePublished
CVE-2026-109374Medium 5.5ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-109373High 8.1ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-109372High 8.7ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-109371High 8.2ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
Assigned by VulnCheck
Oct 12, 2026
CVE-2026-105215Critical 9.1ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105214Low 2.3Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105213High 8.2ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105212High 7.5ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105211High 8.1ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105210High 8.2ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105209Critical 9.6ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105208High 7.7ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105207Critical 9.8ZITADEL before 4.17.3 Account Takeover via External IdP Linking
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-105206Medium 5.3ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-85056High 8.2ZITADEL: MFA bypass via session reuse in Login V2
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-85057High 8.7ZITADEL: Actions V1 sandbox escape: host file read via require()
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-76081Medium 5.5ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
Assigned by GitHub_M
Sep 14, 2026
CVE-2026-44671High 7.5ZITADEL is an open source identity management platform.May 14, 2026
CVE-2026-33132Medium 5.3ZITADEL is an open source identity management platform.Mar 20, 2026
CVE-2026-32132High 7.4ZITADEL is an open source identity management platform.Mar 11, 2026
CVE-2026-32131High 7.7ZITADEL is an open source identity management platform.Mar 11, 2026
CVE-2026-32130High 7.5ZITADEL is an open source identity management platform.Mar 11, 2026
CVE-2026-29193High 8.2ZITADEL is an open source identity management platform.Mar 7, 2026
CVE-2026-29192High 7.7ZITADEL is an open source identity management platform.Mar 7, 2026
CVE-2026-29191Critical 9.3ZITADEL is an open source identity management platform.Mar 7, 2026
CVE-2026-29067Critical 9.3ZITADEL is an open source identity management platform.Mar 7, 2026
CVE-2026-27946Medium 6.5ZITADEL is an open source identity management platform.Feb 26, 2026
CVE-2026-27945Medium 6.5ZITADEL is an open source identity management platform.Feb 26, 2026
CVE-2026-27840Medium 4.3ZITADEL is an open source identity management platform.Feb 26, 2026
CVE-2026-23511Medium 5.3ZITADEL is an open source identity management platform.Jan 15, 2026
CVE-2025-67717Medium 4.3ZITADEL is an open-source identity infrastructure tool.Dec 11, 2025
CVE-2025-67495Medium 6.1ZITADEL is an open-source identity infrastructure tool.Dec 9, 2025
CVE-2025-67494High 8.6ZITADEL is an open-source identity infrastructure tool.Dec 9, 2025
CVE-2025-64717Critical 9.8ZITADEL is an open source identity management platform.Nov 13, 2025
CVE-2025-64103Critical 9.8Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers.Oct 29, 2025
CVE-2025-64102Critical 9.8Zitadel is open-source identity infrastructure software.Oct 29, 2025
CVE-2025-64101High 8.8Zitadel is open-source identity infrastructure software.Oct 29, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.