CVE-2026-29192

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29192
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
History

10 Mar 2026, 17:54

Type Values Removed Values Added
First Time Zitadel
Zitadel zitadel
CPE cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
Summary
  • (es) ZITADEL es una plataforma de gestión de identidades de código abierto. Desde la versión 4.0.0 hasta la 4.11.1, se descubrió una vulnerabilidad en la interfaz de inicio de sesión V2 de Zitadel que permitía una posible toma de control de cuenta a través de la redirección de URI predeterminada. Este problema ha sido parcheado en la versión 4.12.0.
References () https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7 - () https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7 - Patch, Vendor Advisory

07 Mar 2026, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-07 15:15

Updated : 2026-03-10 17:54

NVD link : CVE-2026-29192

Mitre link : CVE-2026-29192

CVE.ORG link : CVE-2026-29192

JSON object : View

Products Affected

zitadel

  • zitadel
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')