Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

ZITADEL

Security incidents tagged ZITADEL. Newest first.

1 ZITADEL incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
1
Days without an incident
0
Longest quiet run: 0 days
All tags →
  • Patched

    ZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5

    ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.

    ZITADELSince Oct 29, 2026

Sponsored

Buy sponsor slot