CVE Tools
Track your stack

Zitadel

32 CVEs tracked since 2026. Since Mar 2026, none of them reached CISA KEV.

Zitadel CVEs per month

Mar 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Zitadel CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0380
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-07100
2026-088 or fewer
2026-099 or fewer
2026-10140

Products

The products that kept showing up in Zitadel's monthly top three, with their CVEs summed over those months.

  1. Zitadel323 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Zitadel.

  1. CVE-2026-119129ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval8.1
  2. CVE-2026-119128ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie7.4
  3. CVE-2026-119127ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection8.1
  4. CVE-2026-109374ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation5.5
  5. CVE-2026-109373ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie8.1
  6. CVE-2026-109372ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion8.7
  7. CVE-2026-109371ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V18.2
  8. CVE-2026-105215ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback9.1
  9. CVE-2026-105214Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification—
  10. CVE-2026-105213ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations8.2
  11. CVE-2026-105212ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment7.5
  12. CVE-2026-105211ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode8.1
  13. CVE-2026-105209ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment9.6
  14. CVE-2026-105210ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers8.2
  15. CVE-2026-105207ZITADEL before 4.17.3 Account Takeover via External IdP Linking9.8

The record

Peak rank
#110 in Oct 2026
Busiest month shown
Oct 2026, 14 CVEs
Months with a KEV entry
0 since Mar 2026
Monthly snapshots
3 since 2026
Zitadel's full record, month by month