CVE-2026-29192
Open Redirect in ZITADEL Login V2 Enables Account Takeover
Publication date: 2026-03-07
Last updated on: 2026-03-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 4.0.0 (inc) to 4.12.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-29192 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Zitadel versions 4.0.0 through 4.11.1, specifically in the login V2 interface.'}, {'type': 'paragraph', 'content': 'The vulnerability arises from the default redirect URI setting that organization administrators can configure, which allows redirecting users to arbitrary locations after login.'}, {'type': 'paragraph', 'content': "Due to insufficient restrictions and improper input handling, an attacker can inject malicious JavaScript code into the login UI that executes in the victim's browser."}, {'type': 'paragraph', 'content': "An unauthenticated remote attacker can exploit this to perform a stored XSS attack, enabling them to reset victims' passwords and take over their accounts."}, {'type': 'paragraph', 'content': 'Accounts protected by Multi-Factor Authentication (MFA) or Passwordless authentication are not vulnerable to this attack vector.'}, {'type': 'paragraph', 'content': "The vulnerability was fixed in Zitadel version 4.12.0 by preventing execution of injected code in the login UI and enforcing that the password change page always requires the user's current password."}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to an account takeover by allowing an attacker to inject malicious code that resets user passwords without their consent.
An attacker exploiting this flaw can gain unauthorized access to user accounts, compromising confidentiality and integrity of user data.
However, accounts secured with Multi-Factor Authentication (MFA) or Passwordless authentication are protected against this attack.
The vulnerability does not impact system availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Zitadel to version 4.12.0 or later.
Additionally, accounts protected by Multi-Factor Authentication (MFA) or Passwordless authentication are not vulnerable to this attack vector, so enabling these protections can help reduce risk.