Go/github.com/zitadel/zitadel CVE-2026-27840: unknown, EPSS 0.16%

ZITADEL's truncated opaque tokens are still valid in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260216092519-feab8e1fa371 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260216092519-feab8e1fa371

Affected

Fixed versions

Sources

• osv: GO-2026-4573
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5
• https://nvd.nist.gov/vuln/detail/CVE-2026-27840
• https://github.com/zitadel/zitadel/commit/feab8e1fa371f3ad654640fc869b2c14f2fdb602
• https://github.com/zitadel/zitadel/releases/tag/v2.71.19
• https://github.com/zitadel/zitadel/releases/tag/v3.4.7
• https://github.com/zitadel/zitadel/releases/tag/v4.11.0

CVE-2026-27840 · published 2026-03-10T18:28:01Z · modified 2026-03-23T04:52:45.687870Z · JSON