github.com/zitadel/zitadel vulnerabilities

CVEs whose affected-version data names the github.com/zitadel/zitadel package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

13 CVEsRSS

CVE-2026-56668High· 8.1

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.41%via OSV

CVE-2026-76081Medium· 5.5

ZITADEL is an open source identity management platform

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue s…

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.23%via NVD

CVE-2026-56665Medium· 4.2

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.27%via OSV

CVE-2026-54693High

ZITADEL Users Can Self-Verify Email/Phone via API

ZITADEL Users Can Self-Verify Email/Phone via API

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.34%via GHSA

CVE-2026-56664Medium· 4.2

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.32%via OSV

CVE-2026-55671Low

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.41%via GHSA

CVE-2026-55670Low

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.36%via GHSA

CVE-2026-55672High· 7.4

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.43%via GHSA

GHSA-wxg7-w2v3-w38gMedium· 4.2

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelvia GHSA

CVE-2026-55669Medium· 4.2

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.15%via GHSA

CVE-2023-49097High· 8.1

ZITADEL Account Takeover via Malicious Host Header Injection

ZITADEL Account Takeover via Malicious Host Header Injection

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.77%via OSV

CVE-2023-47111High· 7.3

ZITADEL race condition in lockout policy execution

ZITADEL race condition in lockout policy execution

▾ Twilightzitadel · github.com/zitadel/zitadelEPSS 0.52%via OSV

CVE-2023-22492Medium· 5.9

Zitadel RefreshToken invalidation vulnerability

Zitadel RefreshToken invalidation vulnerability

▾ Sunlitzitadel · github.com/zitadel/zitadelEPSS 0.60%via OSV

github.com/zitadel/zitadel vulnerabilities (CVEs) · VulnSea