Executive brief
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint in github.com/zitadel/zitadel
Affected products
- Go github.com/zitadel/zitadel/v2
- Go github.com/zitadel/zitadel
Junglewise Threat Intelligence
CVE-2026-29191: GO-2026-4607 - ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint in github.com/zitadel/zitadel
CVE-2026-29191 · Severity: low · CVSS 3.1 · Published 2026-03-10
Technologies: github.com/zitadel/zitadel/v2 (Go), github.com/zitadel/zitadel (Go). Vendors: Go.
Related threats
- ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compati
- ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password v
- ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple proj
- ZITADEL privilege escalation in OAuth2 Token Exchange
- ZITADEL improper authentication in external identity provider auto-linking