ZITADEL

ZITADEL versions 4.0.0 before 4.19.5 are vulnerable to host header injection, allowing unauthenticated attackers to redirect sensitive authentication-related emails to attacker-controlled infrastructure.

An unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 are vulnerable to an authentication bypass via the AddIDPLink endpoint, allowing unauthenticated attackers to link malicious external IdP identities to victim accounts.

An insecure configuration of the goja JavaScript runtime in ZITADEL Actions V1 allows authenticated organization owners to perform a sandbox escape and read arbitrary host files via the require() module loader, leading to potential privilege escalation to instance administrator.

A session-reuse vulnerability in ZITADEL Login V2 (CVE-2026-85056) allows attackers with valid credentials to bypass MFA by abandoning and restarting the login flow in organizations where MFA is not strictly enforced.

A vulnerability in ZITADEL's OAuth2 Token Exchange endpoint (CVE-2026-56668) allows authenticated users to exchange low-privilege tokens for highly privileged tokens by bypassing authorization and scope validation checks.

An improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.

ZITADEL's LDAP identity provider implementation fails to properly escape user-provided usernames before incorporating them into LDAP search filters, allowing unauthenticated attackers to perform LDAP Filter Injection to enumerate usernames and extract sensitive attribute data.