Affected by GO-2024-2637
and 14 other vulnerabilities
GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel
GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel
GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel
GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel
GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel
GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel
GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel
GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel
GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel
GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel
GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel
GO-2025-3499: IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
GO-2025-3671: ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel
This package is not in the latest version of its module.
Documentation
¶
This section is empty.
This section is empty.
This section is empty.
Source Files