Affected by GO-2024-2637 and 12 other vulnerabilities

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

internal/

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/zitadel/zitadel

Links

Open Source Insights

Directories ¶

Path	Synopsis
actions
admin
repository
repository/eventsourcing
repository/eventsourcing/eventstore
repository/eventsourcing/handler
repository/eventsourcing/spooler
repository/eventsourcing/view
api
assets
assets/generator
authz
grpc
grpc/action
grpc/admin
grpc/auth
grpc/authn
grpc/change
grpc/client/middleware
grpc/errors
grpc/features
grpc/idp
grpc/management
grpc/member
grpc/metadata
grpc/object
grpc/org
grpc/policy
grpc/project
grpc/server
grpc/server/middleware
grpc/text
grpc/user
http
http/middleware
oidc
service
auth
repository
repository/eventsourcing
repository/eventsourcing/eventstore
repository/eventsourcing/handler
repository/eventsourcing/spooler
repository/eventsourcing/view
auth_request
model
repository
repository/cache
repository/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
authz
repository
repository/eventsourcing
repository/eventsourcing/eventstore
repository/eventsourcing/handler
repository/eventsourcing/spooler
repository/eventsourcing/view
cache
bigcache
config
fastcache
mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
command
config
systemdefaults
types
crypto Package crypto is a generated GoMock package.	Package crypto is a generated GoMock package.
domain
errors
generate go generate	go generate
eventstore
handler
handler/crdb
repository
repository/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
repository/sql
v1
v1/internal/repository
v1/internal/repository/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
v1/internal/repository/sql
v1/locker
v1/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
v1/models
v1/query
v1/sdk
v1/spooler
v1/spooler/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
form
i18n
iam
model
repository/eventsourcing/model
repository/view
repository/view/model
id
mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
key
model
repository/eventsourcing
repository/eventsourcing/model
repository/view
repository/view/model
notification
channels
channels/chat
channels/fs
channels/log
channels/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
channels/smtp
channels/twilio
messages
repository
repository/eventsourcing
repository/eventsourcing/handler
repository/eventsourcing/spooler
repository/eventsourcing/view
senders
statik
templates
types
org
model
repository/eventsourcing/model
repository/view
repository/view/model
project
model
repository/eventsourcing/model
repository/view
repository/view/model
proto
protoc
protoc-base
protoc-gen-authoption
protoc-gen-authoption/authoption
qrcode
query
projection
projection/flow
projection/org/owner
renderer
repository
action
asset
features
flow
iam
idpconfig
keypair
member
metadata
org
policy
project
user
usergrant
setup
static
config
mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
s3
statik
telemetry
metrics
metrics/config
metrics/otel
tracing
tracing/config
tracing/google
tracing/log
tracing/otel
test
ui
console
login
login/handler
login/static/resources
login/statik
user
model
repository/eventsourcing/model
repository/view
repository/view/model
usergrant
model
repository/eventsourcing/model
repository/view
repository/view/model
view
model
repository
webauthn

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL