← All credits

IAM-marco

11 vulnerability records and advisories credit this contributor.

CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

CVE-2026-105215

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

CVE-2026-105212

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

CVE-2026-105209

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

CVE-2026-105206

ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

CVE-2026-119129

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

CVE-2026-109371

ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

CVE-2026-109374

ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

CVE-2026-109372

ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

CVE-2026-105214

Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification