CVE-2026-29191

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29191
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
History

10 Mar 2026, 17:55

Type Values Removed Values Added
CPE cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
First Time Zitadel
Zitadel zitadel
References () https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq - () https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq - Patch, Vendor Advisory
Summary
  • (es) ZITADEL es una plataforma de gestión de identidades de código abierto. Desde la versión 4.0.0 hasta la 4.11.1, fue descubierta una vulnerabilidad en la interfaz de inicio de sesión V2 de Zitadel que permitía una posible toma de control de cuenta mediante XSS en el endpoint /saml-post. Este problema ha sido parcheado en la versión 4.12.0.

07 Mar 2026, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-07 15:15

Updated : 2026-03-10 17:55

NVD link : CVE-2026-29191

Mitre link : CVE-2026-29191

CVE.ORG link : CVE-2026-29191

JSON object : View

Products Affected

zitadel

  • zitadel
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')