Do Son A critical 9.3 CVSS XSS vulnerability (CVE-2026-29191) in ZITADEL's SAML endpoint allows unauthenticated 1-click account takeover. Upgrade immediately.
ZITADEL
ZITADEL patched three high-severity flaws. Critical SSRF (9.3) allows internal breach via x-forward-host; XSS and Host Header Injection risk account hijack. Update to v4.7.1 immediately.
A ZITADEL vulnerability allows host header injection to hijack user accounts via password reset links. Update to 3.2.2+ or configure proxy.
Learn about CVE-2025-27507 vulnerabilities in ZITADEL's Admin API that could compromise user accounts and settings.