Vendor
low
advisory
Zitadel User API Verification Code Disclosure Vulnerability
1 TTP 1 CVEAn improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.
Zitadel 4.x +2
identity-management
auth-bypass
api-security
1t
1c
high
advisory
ZITADEL LDAP Filter Injection Vulnerability in Login Flow
2 rules 1 IOCZITADEL's LDAP identity provider implementation fails to properly escape user-provided usernames before incorporating them into LDAP search filters, allowing unauthenticated attackers to perform LDAP Filter Injection to enumerate usernames and extract sensitive attribute data.
ZITADEL +2
ldap-injection
information-disclosure
2r
1i