tocsin

CVE-2026-27840

2 advisories.

Go/github.com/zitadel/zitadel CVE-2026-27840: medium 4.3, EPSS 0.23%

ZITADEL's truncated opaque tokens are still valid

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260216092519-feab8e1fa371 or later.

go get github.com/zitadel/zitadel@v4.11.0
go get github.com/zitadel/zitadel@v3.4.7
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260216092519-feab8e1fa371

Affected

introducedfixedlast affected
4.0.04.11.0-
3.0.03.4.7-
2.31.0-2.71.19
01.80.0-v2.20.0.20260216092519-feab8e1fa371-

Fixed versions

4.11.03.4.71.80.0-v2.20.0.20260216092519-feab8e1fa371

Sources

CVE-2026-27840 · published · modified · JSON

Go/github.com/zitadel/zitadel CVE-2026-27840: unknown, EPSS 0.23%

ZITADEL's truncated opaque tokens are still valid in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260216092519-feab8e1fa371 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260216092519-feab8e1fa371

Affected

introducedfixedlast affected
0--
0--
0--
01.80.0-v2.20.0.20260216092519-feab8e1fa371-

Fixed versions

1.80.0-v2.20.0.20260216092519-feab8e1fa371

Sources

CVE-2026-27840 · published · modified · JSON