zitadel has 34 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 19 in the last 90 days against 8 in the 90 before. The busiest recent month was October 2026 with 14. The median CVSS is 7.7 (high), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-287 (7) and CWE-863 (4). Most affected products: zitadel (21), github.com/zitadel/zitadel (13).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 19 prev 8
Products
- zitadel 21
- github.com/zitadel/zitadel 13
Worst active — by depth score
CVE-2025-67494Critical· 9.3ZITADEL is an open-source identity infrastructure tool63CVE-2026-105207Critical· 9.8ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via …54CVE-2026-105209Critical· 9.6ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's…53CVE-2026-105215Critical· 9.1ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed Id…50CVE-2026-109372High· 8.7ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user fr…48
zitadel vulnerabilities
CVEs affecting zitadel, newest first. Open any entry for full detail, references, and exploit status.
34 CVEsRSS
CVE-2024-32868Medium· 6.5PoCZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount…
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection
ZITADEL Account Takeover via Malicious Host Header Injection
CVE-2023-47111High· 7.3ZITADEL race condition in lockout policy execution
ZITADEL race condition in lockout policy execution
CVE-2023-22492Medium· 5.9Zitadel RefreshToken invalidation vulnerability
Zitadel RefreshToken invalidation vulnerability