#ZITADEL
All CosmicBytez Labs articles tagged #ZITADEL, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105207: ZITADEL Unauthenticated Account Takeover via Unverified IdP Linking
ZITADEL links accounts to external identity providers without verifying a primary factor, letting attackers sign in as any known user.
- Newsletter
Mar 11 Digest: npm Supply Chain Seizes AWS Admin, 3.4M
This week: UNC6426 weaponizes a stale npm supply chain compromise to seize full AWS admin in 72 hours, Cognizant TriZetto leaks 3.4 million patient...
- Security
CVE-2026-29067: ZITADEL Password Reset Poisoned by Host Header Injection
A high-severity host header injection vulnerability in ZITADEL's login V2 password reset flow allows attackers to redirect reset links to...
- Security
ZITADEL Critical XSS in SAML Endpoint Enables 1-Click
A critical cross-site scripting vulnerability in ZITADEL's login V2 /saml-post endpoint allows unauthenticated attackers to execute arbitrary JavaScript...
- Security
CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI
A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...