#Identity Provider
All CosmicBytez Labs articles tagged #Identity Provider, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105215: ZITADEL Account Pre-Hijacking via Forged External IdP Callback
Unauthenticated attackers can forge IdP identity fields in ZITADEL's Login V1 UI to pre-hijack victim accounts before they ever log in.
- Security
CVE-2026-105207: ZITADEL Unauthenticated Account Takeover via Unverified IdP Linking
ZITADEL links accounts to external identity providers without verifying a primary factor, letting attackers sign in as any known user.
- Security
CVE-2026-42849: authentik Critical XSS in AutosubmitStage (CVSS 9.3)
A critical cross-site scripting vulnerability in authentik's Simple Flow Executor AutosubmitStage allows attackers to execute arbitrary JavaScript via a…
- Security
CVE-2026-49448: authentik Source Stage Authentication Bypass (CVSS 9.8)
A critical authentication bypass in authentik allows attackers to skip the Source stage entirely by sending an empty POST request, completely circumventing…
- Security
CVE-2026-29067: ZITADEL Password Reset Poisoned by Host Header Injection
A high-severity host header injection vulnerability in ZITADEL's login V2 password reset flow allows attackers to redirect reset links to...
- Security
ZITADEL Critical XSS in SAML Endpoint Enables 1-Click
A critical cross-site scripting vulnerability in ZITADEL's login V2 /saml-post endpoint allows unauthenticated attackers to execute arbitrary JavaScript...
- Security
CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI
A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...