ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowe…

Published:

6 maart 2026 om 23:00:00

Alert date:

7 maart 2026 om 16:02:28

Source:

nvd.nist.gov

Identity & Access, Web Technologies

ZITADEL, an open source identity management platform, contains a cross-site scripting (XSS) vulnerability in its login V2 interface that could lead to account takeover. The vulnerability affects the /saml-post endpoint in versions 4.0.0 through 4.11.1. Attackers could potentially exploit this XSS flaw to compromise user accounts through malicious scripts. The vulnerability has been patched in version 4.12.0. Organizations using affected versions should upgrade immediately to mitigate the risk of account compromise.

Technical details

Mitigation steps:

Affected products:

ZITADEL