PT-2026-23104 · Zitadel · Zitadel

Amit-Laish · Published 2026-03-04 · Updated 2026-03-25 · CVE-2026-29191

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.11.1

Description ZITADEL, an open source identity management platform, contains a cross-site scripting (XSS) issue in its login V2 interface, specifically within the /saml-post endpoint. This flaw allows for potential account takeover by enabling the execution of malicious JavaScript code in a victim’s browser. The issue stems from insecure redirection using the url parameter and reflection of user-supplied input without proper HTML encoding. An unauthenticated attacker can exploit this by crafting a malicious link, potentially resetting passwords and gaining control of accounts. The vulnerability does not require SAML integration to be exploited and can affect Zitadel in its default configuration. The /saml-post endpoint accepts the url and id parameters.

Recommendations Upgrade to ZITADEL version 4.12.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29191

GHSA-PR34-2V5X-6QJQ

GO-2026-4607

SUSE-SU-2026:1042-1

Affected Products

Zitadel

References · 149

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29191.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29191 · Security Note
• https://osv.dev/vulnerability/GO-2026-4607 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29191 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pr34-2v5x-6qjq · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://suse.com/security/cve/CVE-2026-27138 · Note
• https://suse.com/security/cve/CVE-2026-26998 · Note
• https://suse.com/security/cve/CVE-2026-28280 · Note
• https://suse.com/security/cve/CVE-2026-29192 · Note
• https://suse.com/security/cve/CVE-2026-27819 · Note
• https://suse.com/security/cve/CVE-2026-29061 · Note
• https://twitter.com/CCBalert/status/2033557648344248762 · Twitter Post