# ZITADEL vulnerabilities Source: https://junglewise.ai/threats/vendors/zitadel Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/zitadel.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in ZITADEL: 0 in the last 7 days and 19 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119129, was published on 29 October 2026. 6 vulnerabilities in the last four weeks, down 54% on the four before (13). 0 critical against 3. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 19 - All time: 37 (7 critical, 0 exploited in the wild) ## About ZITADEL Identity and access management platform providing authentication and authorization services. ## Latest ZITADEL vulnerabilities - [CVE-2026-119129: ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-119128: ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass) (high, CVSS 7.4, published 29 Oct 2026) - [CVE-2026-119127: ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-109374: ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation) (medium, CVSS 5.5, published 12 Oct 2026) - [CVE-2026-109373: ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-109371: ZITADEL hosted Login V1 authentication bypass in username change](https://junglewise.ai/threats/cve-2026-109371-zitadel-3-0-0-before-4-18-0-contains-a-missing-authentication) (high, CVSS 8.2, published 12 Oct 2026) - [CVE-2026-105215: ZITADEL authentication bypass in Login V1 UI](https://junglewise.ai/threats/cve-2026-105215-zitadel-before-3-4-14-and-4-x-before-4-16-2-contains-an) (critical, CVSS 9.1, published 4 Oct 2026) - [CVE-2026-105214: Zitadel server-side request forgery in domain verification](https://junglewise.ai/threats/cve-2026-105214-zitadel-before-4-16-2-contains-a-server-side-request-forgery) (info, published 4 Oct 2026) - [CVE-2026-105213: ZITADEL authentication bypass via Login V2 for deactivated organizations](https://junglewise.ai/threats/cve-2026-105213-zitadel-4-x-before-4-17-1-does-not-check-an-organization-s) (high, CVSS 8.2, published 4 Oct 2026) - [CVE-2026-105212: ZITADEL authentication bypass in Login UI via passkey enrollment](https://junglewise.ai/threats/cve-2026-105212-zitadel-3-x-before-3-4-14-and-4-x-before-4-16-2-contains-an) (high, CVSS 7.5, published 4 Oct 2026) - [CVE-2026-105211: ZITADEL authentication bypass in Login V2 OTP handling](https://junglewise.ai/threats/cve-2026-105211-zitadel-before-4-17-1-contains-an-authentication-bypass) (high, CVSS 8.1, published 4 Oct 2026) - [CVE-2026-105210: ZITADEL missing authentication in Login V1 MFA enrollment](https://junglewise.ai/threats/cve-2026-105210-zitadel-3-x-before-3-4-15-and-4-x-before-4-17-1-contains-a) (high, CVSS 8.2, published 4 Oct 2026) - [CVE-2026-105209: ZITADEL improper authorization in passkey and passwordless enrollment](https://junglewise.ai/threats/cve-2026-105209-zitadel-3-x-before-3-4-15-and-4-x-before-4-17-1-contains-an) (critical, CVSS 9.6, published 4 Oct 2026) - [CVE-2026-105208: ZITADEL IdP intent token forgery in external login](https://junglewise.ai/threats/cve-2026-105208-zitadel-4-x-before-4-17-3-and-3-x-through-3-4-15-protects-idp) (high, CVSS 7.7, published 4 Oct 2026) - [CVE-2026-105207: ZITADEL account takeover via external identity provider linking](https://junglewise.ai/threats/cve-2026-105207-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-17-3-creates) (critical, CVSS 9.8, published 4 Oct 2026) - [CVE-2026-105206: ZITADEL incorrect authorization in User Service API](https://junglewise.ai/threats/cve-2026-105206-zitadel-3-0-0-through-3-4-15-and-4-x-before-4-17-3-contains-an) (info, published 4 Oct 2026) - [CVE-2026-85057: ZITADEL Actions V1 sandbox escape via require() filesystem read](https://junglewise.ai/threats/cve-2026-85057-zitadel-actions-v1-sandbox-escape-via-require-filesystem-read) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse](https://junglewise.ai/threats/cve-2026-85056-zitadel-login-v2-mfa-bypass-via-session-reuse) (high, CVSS 8.2, published 24 Sep 2026) - [CVE-2026-76081: ZITADEL improper role revocation on granted projects](https://junglewise.ai/threats/cve-2026-76081-zitadel-improper-role-revocation-on-granted-projects) (medium, CVSS 5.5, published 14 Sep 2026) - [CVE-2026-54693: ZITADEL incorrect authorization in email and phone self-management API](https://junglewise.ai/threats/cve-2026-54693-zitadel-incorrect-authorization-in-email-and-phone-self) (high, CVSS 4, published 29 Jul 2026) - [CVE-2026-56668: ZITADEL privilege escalation in OAuth2 Token Exchange](https://junglewise.ai/threats/cve-2026-56668-zitadel-privilege-escalation-in-oauth2-token-exchange) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-56667: ZITADEL stored XSS in OIDC and SAML login error paths](https://junglewise.ai/threats/cve-2026-56667-zitadel-stored-xss-in-oidc-and-saml-login-error-paths) (high, CVSS 7.3, published 10 Jul 2026) - [CVE-2026-56666: ZITADEL improper authentication in external identity provider auto-linking](https://junglewise.ai/threats/cve-2026-56666-zitadel-improper-authentication-in-external-identity-provider) (medium, CVSS 4.8, published 10 Jul 2026) - [CVE-2026-56665: ZITADEL insufficient session expiration in JWT Identity Provider](https://junglewise.ai/threats/cve-2026-56665-zitadel-insufficient-session-expiration-in-jwt-identity-provider) (medium, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-56664: ZITADEL insufficient session expiration in JWT Identity Provider](https://junglewise.ai/threats/cve-2026-56664-zitadel-insufficient-session-expiration-in-jwt-identity-provider) (medium, CVSS 4.2, published 10 Jul 2026) ## Most severe ZITADEL vulnerabilities - [CVE-2025-64717: GO-2025-4124 - ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64717-zitadel-is-vulnerable-to-account-takeover-with-deactivated) (critical, CVSS 9.8, published 13 Nov 2025) - [CVE-2025-64102: GO-2025-4085 - Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64102-zitadel-allows-brute-forcing-authentication-factors) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-64103: GO-2025-4083 - Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-64103-zitadel-may-bypass-second-authentication-factor) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2026-105207: ZITADEL account takeover via external identity provider linking](https://junglewise.ai/threats/cve-2026-105207-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-17-3-creates) (critical, CVSS 9.8, published 4 Oct 2026) - [CVE-2026-105209: ZITADEL improper authorization in passkey and passwordless enrollment](https://junglewise.ai/threats/cve-2026-105209-zitadel-3-x-before-3-4-15-and-4-x-before-4-17-1-contains-an) (critical, CVSS 9.6, published 4 Oct 2026) - [CVE-2025-67494: GO-2025-4210 - ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel](https://junglewise.ai/threats/cve-2025-67494-zitadel-vulnerable-to-unauthenticated-full-read-ssrf-via-v2-login) (critical, CVSS 9.3, published 9 Dec 2025) - [CVE-2026-105215: ZITADEL authentication bypass in Login V1 UI](https://junglewise.ai/threats/cve-2026-105215-zitadel-before-3-4-14-and-4-x-before-4-16-2-contains-an) (critical, CVSS 9.1, published 4 Oct 2026) - [CVE-2026-85057: ZITADEL Actions V1 sandbox escape via require() filesystem read](https://junglewise.ai/threats/cve-2026-85057-zitadel-actions-v1-sandbox-escape-via-require-filesystem-read) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-109371: ZITADEL hosted Login V1 authentication bypass in username change](https://junglewise.ai/threats/cve-2026-109371-zitadel-3-0-0-before-4-18-0-contains-a-missing-authentication) (high, CVSS 8.2, published 12 Oct 2026) - [CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse](https://junglewise.ai/threats/cve-2026-85056-zitadel-login-v2-mfa-bypass-via-session-reuse) (high, CVSS 8.2, published 24 Sep 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 54% on the four before (13). 0 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 10 | 3 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## ZITADEL technologies - [ZITADEL](https://junglewise.ai/threats/technologies/zitadel): 37 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ZITADEL vulnerabilities", https://junglewise.ai/threats/vendors/zitadel, 12 November 2026.