ZITADEL, an open source identity management platform, contains a cross-site scripting (XSS) vulnerability in its login V2 interface that could lead to account takeover. The vulnerability affects the /saml-post endpoint in versions 4.0.0 through 4.11.1. Attackers could potentially exploit this XSS flaw to compromise user accounts through malicious scripts. The vulnerability has been patched in version 4.12.0. Organizations using affected versions should upgrade immediately to mitigate the risk of account compromise.