CVE-2026-85057

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

ZITADEL is an open source identity management platform. A vulnerability in the federation process allows auto-linking users from external identity providers to existing users even if the IdP is inactive or federation is disallowed. This stems from failure to enforce organization-specific security settings during authentication.

ZITADEL, an open source identity management platform, from 4.0.0 until 4.16.1 contains a vulnerability in Login V2 that creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

A vulnerability in ZITADEL prior to version 4.15.3 allows a low-privilege token to be exchanged for elevated permissions in another application. This occurs because the OAuth2 Token Exchange endpoint does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes.

In ZITADEL prior to version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check. This allows an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached.

In ZITADEL prior to version 4.15.3, the external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email. This allows a permissive provider account with a victim email address to be linked to the victim's local account.

A vulnerability in ZITADEL (versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1) causes external JWT validation to skip expiration handling when the token lacks the exp claim. A token from a trusted issuer is treated as valid without an automatic expiration window.

In ZITADEL prior to versions 3.4.12 and 4.15.2, the external JWT Identity Provider validation skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication.