PT-2026-23105 · Zitadel · Zitadel

Amit Laish · Published 2026-03-04 · Updated 2026-03-25 · CVE-2026-29192

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.11.1

Description ZITADEL, an open source identity management platform, has a flaw in its login V2 interface that could allow for account takeover via Default URI Redirect. An unauthenticated remote attacker can exploit a Stored XSS vulnerability to reset passwords and take over accounts. This is due to missing restrictions and improper handling of the default redirect URI, allowing malicious JavaScript code to be executed in the Zitadel login UI. The issue is mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. The vulnerable component is the login V2 interface.

Recommendations Upgrade to version 4.12.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29192

GHSA-6RX5-M2RC-HMF7

GO-2026-4605

SUSE-SU-2026:1042-1

Affected Products

Zitadel

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29192.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4605 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6rx5-m2rc-hmf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29192 · Security Note
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.12.0 · Note
• https://suse.com/security/cve/CVE-2026-29195 · Note
• https://suse.com/security/cve/CVE-2026-30851 · Note
• https://suse.com/security/cve/CVE-2026-27965 · Note
• https://suse.com/security/cve/CVE-2026-31961 · Note
• https://suse.com/security/cve/CVE-2026-27896 · Note
• https://suse.com/security/cve/CVE-2026-26276 · Note