CVE-2026-85056

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

ZITADEL is an open source identity management platform. A vulnerability in the federation process allows auto-linking users from external identity providers to existing users even if the IdP is inactive or federation is disallowed. This stems from failure to enforce organization-specific security settings during authentication.

ZITADEL, an open source identity management platform, from 3.0.0 until 3.4.13 and 4.16.1 contains a vulnerability in Actions V1 that enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. This issue is fixed in versions 3.4.13 and 4.16.1.

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

A vulnerability in ZITADEL prior to version 4.15.3 allows a low-privilege token to be exchanged for elevated permissions in another application. This occurs because the OAuth2 Token Exchange endpoint does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes.

In ZITADEL prior to version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check. This allows an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached.

In ZITADEL prior to version 4.15.3, the external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email. This allows a permissive provider account with a victim email address to be linked to the victim's local account.

A vulnerability in ZITADEL (versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1) causes external JWT validation to skip expiration handling when the token lacks the exp claim. A token from a trusted issuer is treated as valid without an automatic expiration window.

In ZITADEL prior to versions 3.4.12 and 4.15.2, the external JWT Identity Provider validation skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication.