Executive brief
ZITADEL is an open-source identity management platform used to manage user authentication and access. A security flaw in the login system allows administrators to configure malicious redirect links that can execute unauthorized code in a user's browser. If a user encounters a login error, such as an expired session, they could be automatically redirected to a malicious script, potentially leading to account takeover or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ZITADEL's Login V2 OIDC and SAML 'FailedPrecondition' error paths. The application returns 'loginSettings.defaultRedirectUri' to 'router.push()' without applying the 'isSafeRedirectUri' validation check. An attacker with organization or instance administrator privileges can store a 'javascript:' or 'data:' URI as the default redirect. When a user reaches an affected error path (e.g., via a stale or expired login link), the browser executes the malicious payload. This issue is a bypass of a previous fix (GHSA-6rx5-m2rc-hmf7) and is resolved in version 4.15.3 by ensuring uniform validation across all redirect paths.
Affected products
- ZITADEL ZITADEL >= 4.0.0, < 4.15.3
Timeline
- 2026-06-22: patched: Version 4.15.3 released
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD