CVE-2026-29191

⛔ critical

Summary

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

CVSS Score

9.3

Critical

EPSS Score

0.0

Exploit Probability

Published Date

2026-03-07

First Seen: 2026-03-08

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 88.6% of all 330,193 vulnerabilities in our database.

#37,637

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Mar 9, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-03-10

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE IDs (Weakness Types)

CWE-79

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
zitadel	zitadel	Affected	> 4.0.0 < 4.12.0

🔗 References 1

https://github.com/zitadel/zitadel/security/advisori...

Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44671	⚠️ high	7.5	0.3	ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was di...	2026-05-14
CVE-2026-33132	🔶 medium	5.3	0.1	ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users t...	2026-03-20
CVE-2026-32130	⚠️ high	7.5	0.2	ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a Syste...	2026-03-11
CVE-2026-32131	⚠️ high	7.7	0.0	ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Manageme...	2026-03-11
CVE-2026-32132	⚠️ high	7.4	0.0	ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Z...	2026-03-11
CVE-2026-29067	⚠️ high	8.1	0.0	ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exis...	2026-03-07

These CVEs affect the same products