Z
Vendor security profile
zitadel
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs17
Critical6
CISA KEV0
Public exploit0
Patch rate%12
Avg. CVSS7.9
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
3
14
CVE KEV
CVE severity distribution
17toplam CVE
Critical6 (35%)
High7 (41%)
Medium3 (18%)
Low1 (6%)
Patch and exploitation view
%12
Verified patch
%0
CISA KEV
%0
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
15Unknown
Latest vulnerabilities
5.1
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
Z
Patch status unknown
9.2
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
Z
Patch status unknown
9.3
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Z
Patch status unknown
8.8
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
Z
Patch status unknown
9.3
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
Z
Patch status unknownEPSS %0
2.3
CVE-2026-105214
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
Z
Patch status unknownEPSS %0
8.8
CVE-2026-105213
ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
Z
Patch status unknownEPSS %0
8.7
CVE-2026-105212
ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
Z
Patch status unknownEPSS %0
9.2
CVE-2026-105211
ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
Z
Patch status unknownEPSS %0
8.8
CVE-2026-105210
ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
Z
Patch status unknownEPSS %0