https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 03:11:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275015 EUVD-2026-275015 https://cve.radiocsirt.org/vuln/euvd-2026-275015 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29193 <p>ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel&#39;s login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton. This issue has been patched in version 4.12.1.</p> <p>ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel&#39;s login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton. This issue has been patched in version 4.12.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29193 https://cve.radiocsirt.org/vuln/ghsa-25rw-g6ff-fmg8 <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel/v2, Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel&#39;s login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton.</p> <p>### Impact</p> <p>Zitadel enables administrators to configure their organization’s login behavior and security policies. As part of this functionality, they can disable user self-registration, enforce passwordless logins only, and more.</p> <p>Due to improper enforcement an attacker could send direct HTTP requests to the login UI and create accounts in organizations that have disabled user self-registration, and gain unauthorized access to the system. The same attack vector could be used to authenticate for example using username and password even when this login method was disabled.</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.12.0` (including RC versions)</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the policies on the logiin UI server.</p> <p>4.x: Upgrade to &gt;=[4.12.1](https://github.com/zitadel/zitadel/releases/tag/v4.12.1)</p> <p>### Workarounds</p> <p>The recommended solution is to upgrade to a patched version.</p> <p>### Questions</p> <p>If there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)</p> <p>### Credits</p> <p>ZITADEL extends thanks once again to Amit Laish fro…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel/v2, Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel&#39;s login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton.</p> <p>### Impact</p> <p>Zitadel enables administrators to configure their organization’s login behavior and security policies. As part of this functionality, they can disable user self-registration, enforce passwordless logins only, and more.</p> <p>Due to improper enforcement an attacker could send direct HTTP requests to the login UI and create accounts in organizations that have disabled user self-registration, and gain unauthorized access to the system. The same attack vector could be used to authenticate for example using username and password even when this login method was disabled.</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.12.0` (including RC versions)</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the policies on the logiin UI server.</p> <p>4.x: Upgrade to &gt;=[4.12.1](https://github.com/zitadel/zitadel/releases/tag/v4.12.1)</p> <p>### Workarounds</p> <p>The recommended solution is to upgrade to a patched version.</p> <p>### Questions</p> <p>If there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)</p> <p>### Credits</p> <p>ZITADEL extends thanks once again to Amit Laish fro…</p> https://cve.radiocsirt.org/vuln/ghsa-25rw-g6ff-fmg8