Zitadel Login Interface Allows Attackers to Hijack User Accounts

Summary

Zitadel's login system for some versions had a security flaw that could allow hackers to take control of user accounts. This is a serious issue because it could lead to unauthorized access to sensitive information. The good news is that the issue has been fixed in a newer version of Zitadel, so it's essential to update to the latest version to protect your users.

What to do

Update github.com zitadel to version 4.12.0.
Update zitadel github.com/zitadel/zitadel to version 4.12.0.
Update zitadel github.com/zitadel/zitadel/v2 to version 4.12.0.

Affected software

Vendor	Product	Affected versions	Fix available
github.com	zitadel	> 4.0.0 , <= 4.12.0	4.12.0
github.com	zitadel	> 4.0.0 , <= 4.12.0	4.12.0
zitadel	github.com/zitadel/zitadel	> 4.0.0 , <= 4.12.0	4.12.0
zitadel	github.com/zitadel/zitadel/v2	> 4.0.0 , <= 4.12.0	4.12.0
zitadel	zitadel	> 4.0.0 , <= 4.12.0	–

Original title

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS...

Original description

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

ghsa CVSS3.1 9.3

Vulnerability type

CWE-79 Cross-site Scripting (XSS)