Is CVE-2026-56667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56667 being exploited in the wild.

How severe is CVE-2026-56667?

High severity, with a CVSS score of 7.3, published 10 July 2026.

Is there a fix for CVE-2026-56667?

A patch was published on 2026-06-22: Version 4.15.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56667 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56667?

Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56667: ZITADEL stored XSS in OIDC and SAML login error paths

CVE-2026-56667 · Severity: high · CVSS 7.3 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage user authentication and access. A security flaw in the login system allows administrators to configure malicious redirect links that can execute unauthorized code in a user's browser. If a user encounters a login error, such as an expired session, they could be automatically redirected to a malicious script, potentially leading to account takeover or data theft.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-56667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56667 being exploited in the wild.
How severe is CVE-2026-56667?: High severity, with a CVSS score of 7.3, published 10 July 2026.
Which products and versions are affected?: ZITADEL >= 4.0.0, < 4.15.3.
Is there a fix for CVE-2026-56667?: A patch was published on 2026-06-22: Version 4.15.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56667 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56667?: Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in ZITADEL's Login V2 OIDC and SAML 'FailedPrecondition' error paths. The application returns 'loginSettings.defaultRedirectUri' to 'router.push()' without applying the 'isSafeRedirectUri' validation check. An attacker with organization or instance administrator privileges can store a 'javascript:' or 'data:' URI as the default redirect. When a user reaches an affected error path (e.g., via a stale or expired login link), the browser executes the malicious payload. This issue is a bypass of a previous fix (GHSA-6rx5-m2rc-hmf7) and is resolved in version 4.15.3 by ensuring uniform validation across all redirect paths.

Affected products

ZITADEL ZITADEL >= 4.0.0, < 4.15.3

Timeline

2026-06-22: patched: Version 4.15.3 released
2026-06-22: advisory: GitHub Security Advisory published
2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.