CVE-2026-29191

CRITICAL

ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-29191 has a selected CVSS score of 9.3 (critical).

Description

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 9, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

zitadel

Browse zitadel / zitadel
CVE List>= 4.0.0, < 4.12.0affected

github.com/zitadel/zitadel

Browse Go / github.com/zitadel/zitadel
GitHub Advisory4.0.0 to < 4.12.0 · Fixed in 4.12.0affected

github.com/zitadel/zitadel/v2

Browse Go / github.com/zitadel/zitadel/v2
GitHub Advisory4.0.0 to < 4.12.0 · Fixed in 4.12.0affected

References

3