CPE
ZITADEL: Login V2 UI host header injection (CVE-2026-119127)
2 TTPs 1 CVEZITADEL versions 4.0.0 before 4.19.5 are vulnerable to host header injection, allowing unauthenticated attackers to redirect sensitive authentication-related emails to attacker-controlled infrastructure.
Missing Authentication Vulnerability in ZITADEL Login V1 UI
1 TTP 1 CVEAn unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.
Authentication Bypass in ZITADEL Identity Provider
6 TTPs 1 CVEZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 are vulnerable to an authentication bypass via the AddIDPLink endpoint, allowing unauthenticated attackers to link malicious external IdP identities to victim accounts.
ZITADEL Actions V1 Sandbox Escape via File System Access
1 TTP 1 CVEAn insecure configuration of the goja JavaScript runtime in ZITADEL Actions V1 allows authenticated organization owners to perform a sandbox escape and read arbitrary host files via the require() module loader, leading to potential privilege escalation to instance administrator.
ZITADEL Privilege Escalation via OAuth2 Token Exchange
1 TTP 1 CVEA vulnerability in ZITADEL's OAuth2 Token Exchange endpoint (CVE-2026-56668) allows authenticated users to exchange low-privilege tokens for highly privileged tokens by bypassing authorization and scope validation checks.
Zitadel User API Verification Code Disclosure Vulnerability
1 TTP 1 CVEAn improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.