CVE-2026-29191
CRITICALZITADEL 4.0.0-4.11.1 - XSS
Title source: llmDescription
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.
Scores
CVSS v3
9.3
EPSS
0.0003
EPSS Percentile
9.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Classification
CWE
CWE-79
Status
draft
Affected Products (2)
zitadel/zitadel
< 4.12.0Go
zitadel/zitadel
< 4.12.0Go
Timeline
Published
Mar 07, 2026
Tracked Since
Mar 07, 2026