CVE-2026-56665

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

ZITADEL is an open source identity management platform. A vulnerability in the federation process allows auto-linking users from external identity providers to existing users even if the IdP is inactive or federation is disallowed. This stems from failure to enforce organization-specific security settings during authentication.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

A vulnerability in ZITADEL prior to version 4.15.3 allows a low-privilege token to be exchanged for elevated permissions in another application. This occurs because the OAuth2 Token Exchange endpoint does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes.

In ZITADEL prior to version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check. This allows an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached.

In ZITADEL prior to version 4.15.3, the external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email. This allows a permissive provider account with a victim email address to be linked to the victim's local account.

In ZITADEL prior to versions 3.4.12 and 4.15.2, the external JWT Identity Provider validation skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication.

In ZITADEL prior to versions 3.4.12 and 4.15.2, OAuth2 and OIDC flows (CodeExchange, RefreshToken, device token) fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client.

A vulnerability in ZITADEL from version 4.0.0-rc.1 to 4.15.1 allows SSRF attacks due to inconsistent URL validation in HTTP notification channels, OIDC BackChannel logout, and SAML metadata URL fetches. Attackers can use DNS rebinding, redirects, or protocol downgrades to send requests to loopback, internal IP, or link-local endpoints.

In ZITADEL prior to version 4.15.1, the event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.