# github.com/zitadel/zitadel (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in github.com/zitadel/zitadel (Go): 0 in the last 7 days and 3 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-85057, was published on 24 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 52 (4 critical, 0 exploited in the wild) ## About github.com/zitadel/zitadel (Go) Open-source identity and access management platform written in Go. ## Latest github.com/zitadel/zitadel (Go) vulnerabilities - [CVE-2026-85057: ZITADEL Actions V1 sandbox escape via require() filesystem read](https://junglewise.ai/threats/cve-2026-85057-zitadel-actions-v1-sandbox-escape-via-require-filesystem-read) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse](https://junglewise.ai/threats/cve-2026-85056-zitadel-login-v2-mfa-bypass-via-session-reuse) (high, CVSS 8.2, published 24 Sep 2026) - [CVE-2026-76081: ZITADEL improper role revocation on granted projects](https://junglewise.ai/threats/cve-2026-76081-zitadel-improper-role-revocation-on-granted-projects) (medium, CVSS 5.5, published 14 Sep 2026) - [CVE-2026-54693: ZITADEL incorrect authorization in email and phone self-management API](https://junglewise.ai/threats/cve-2026-54693-zitadel-incorrect-authorization-in-email-and-phone-self) (high, CVSS 4, published 29 Jul 2026) - [CVE-2026-56668: ZITADEL privilege escalation in OAuth2 Token Exchange](https://junglewise.ai/threats/cve-2026-56668-zitadel-privilege-escalation-in-oauth2-token-exchange) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-56666: ZITADEL improper authentication in external identity provider auto-linking](https://junglewise.ai/threats/cve-2026-56666-zitadel-improper-authentication-in-external-identity-provider) (medium, CVSS 4.8, published 10 Jul 2026) - [CVE-2026-56665: ZITADEL insufficient session expiration in JWT Identity Provider](https://junglewise.ai/threats/cve-2026-56665-zitadel-insufficient-session-expiration-in-jwt-identity-provider) (medium, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-56664: ZITADEL insufficient session expiration in JWT Identity Provider](https://junglewise.ai/threats/cve-2026-56664-zitadel-insufficient-session-expiration-in-jwt-identity-provider) (medium, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-55672: ZITADEL improper client verification in OAuth2 and OIDC flows](https://junglewise.ai/threats/cve-2026-55672-zitadel-improper-client-verification-in-oauth2-and-oidc-flows) (high, CVSS 7.4, published 10 Jul 2026) - [CVE-2026-55671: ZITADEL SSRF and denylist bypass in outgoing HTTP components](https://junglewise.ai/threats/cve-2026-55671-zitadel-ssrf-and-denylist-bypass-in-outgoing-http-components) (medium, CVSS 4, published 10 Jul 2026) - [CVE-2026-55670: ZITADEL cross-tenant user leakage via recycled identifiers in event store](https://junglewise.ai/threats/cve-2026-55670-zitadel-cross-tenant-user-leakage-via-recycled-identifiers-in) (medium, CVSS 4, published 10 Jul 2026) - [CVE-2026-55669: ZITADEL missing JWT audience validation in external Identity Provider](https://junglewise.ai/threats/cve-2026-55669-zitadel-missing-jwt-audience-validation-in-external-identity) (medium, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-44671: ZITADEL LDAP injection in login flow](https://junglewise.ai/threats/cve-2026-44671-zitadel-ldap-injection-in-login-flow) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-33132: GO-2026-4751 - Zitadel is missing enforcement of organization scopes in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-33132-zitadel-is-missing-enforcement-of-organization-scopes) (low, CVSS 3.1, published 23 Mar 2026) - [CVE-2026-29191: GO-2026-4607 - ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-29191-zitadel-has-1-click-account-takeover-via-xss-in-saml-post) (low, CVSS 3.1, published 10 Mar 2026) - [CVE-2026-29192: GO-2026-4605 - ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-29192-zitadel-stored-xss-via-default-uri-redirect-leads-to-account) (low, CVSS 3.1, published 10 Mar 2026) - [CVE-2026-29193: ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication](https://junglewise.ai/threats/cve-2026-29193-zitadel-login-v2-ui-policy-bypass-allows-unauthorized-self) (low, CVSS 3.1, published 10 Mar 2026) - [CVE-2026-27945: GO-2026-4574 - ZITADEL has potential SSRF via Actions in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-27945-zitadel-has-potential-ssrf-via-actions) (medium, CVSS 4, published 10 Mar 2026) - [CVE-2026-27946: GO-2026-4572 - ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-27946-zitadel-users-can-self-verify-email-phone-via-updatehumanuser-api) (medium, CVSS 4, published 10 Mar 2026) - [CVE-2026-27840: GO-2026-4573 - ZITADEL's truncated opaque tokens are still valid in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-27840-zitadel-s-truncated-opaque-tokens-are-still-valid) (low, CVSS 3.1, published 10 Mar 2026) - [CVE-2026-23511: GO-2026-4319 - Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2026-23511-zitadel-has-a-user-enumeration-vulnerability-in-login-uis) (low, CVSS 3.1, published 23 Jan 2026) - [CVE-2026-29067: ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login](https://junglewise.ai/threats/cve-2026-29067-zitadel-vulnerable-to-account-takeover-due-to-improper-instance) (low, CVSS 3.1, published 15 Dec 2025) - [CVE-2025-67717: GO-2025-4227 - Zitadel Discloses the Total Number of Instance Users in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67717-zitadel-discloses-the-total-number-of-instance-users) (medium, CVSS 4.3, published 11 Dec 2025) - [CVE-2025-67495: GO-2025-4213 - ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67495-zitadel-vulnerable-to-account-takeover-via-dom-based-xss-in) (high, CVSS 8, published 9 Dec 2025) - [CVE-2025-67494: GO-2025-4210 - ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67494-zitadel-vulnerable-to-unauthenticated-full-read-ssrf-via-v2-login) (critical, CVSS 9.3, published 9 Dec 2025) ## Most severe github.com/zitadel/zitadel (Go) vulnerabilities - [CVE-2025-64717: GO-2025-4124 - ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64717-zitadel-is-vulnerable-to-account-takeover-with-deactivated) (critical, CVSS 9.8, published 13 Nov 2025) - [CVE-2025-64102: GO-2025-4085 - Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64102-zitadel-allows-brute-forcing-authentication-factors) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-64103: GO-2025-4083 - Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64103-zitadel-may-bypass-second-authentication-factor) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-67494: GO-2025-4210 - ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67494-zitadel-vulnerable-to-unauthenticated-full-read-ssrf-via-v2-login) (critical, CVSS 9.3, published 9 Dec 2025) - [CVE-2026-85057: ZITADEL Actions V1 sandbox escape via require() filesystem read](https://junglewise.ai/threats/cve-2026-85057-zitadel-actions-v1-sandbox-escape-via-require-filesystem-read) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse](https://junglewise.ai/threats/cve-2026-85056-zitadel-login-v2-mfa-bypass-via-session-reuse) (high, CVSS 8.2, published 24 Sep 2026) - [CVE-2026-56668: ZITADEL privilege escalation in OAuth2 Token Exchange](https://junglewise.ai/threats/cve-2026-56668-zitadel-privilege-escalation-in-oauth2-token-exchange) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2025-64101: GO-2025-4084 - ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64101-zitadel-vulnerable-to-account-takeover-via-malicious-forwarded) (high, CVSS 8.1, published 29 Oct 2025) - [CVE-2025-67495: GO-2025-4213 - ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67495-zitadel-vulnerable-to-account-takeover-via-dom-based-xss-in) (high, CVSS 8, published 9 Dec 2025) - [CVE-2026-44671: ZITADEL LDAP injection in login flow](https://junglewise.ai/threats/cve-2026-44671-zitadel-ldap-injection-in-login-flow) (high, CVSS 7.5, published 14 May 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/zitadel/zitadel (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel, 13 November 2026.