CVE-2026-29191

Go/github.com/zitadel/zitadel CVE-2026-29191: critical 9.3, EPSS 0.40%

ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

Action: Upgrade github.com/zitadel/zitadel to 4.12.0 or later.

go get github.com/zitadel/zitadel@v4.12.0

Affected

Fixed versions

Sources

• osv: GHSA-pr34-2v5x-6qjq
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq
• https://nvd.nist.gov/vuln/detail/CVE-2026-29191
• https://github.com/zitadel/zitadel

CVE-2026-29191 · published 2026-03-04T22:47:08Z · modified 2026-03-23T04:56:25.187657306Z · JSON

Go/github.com/zitadel/zitadel/v2 CVE-2026-29191: critical 9.3, EPSS 0.40%

ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

Action: Upgrade github.com/zitadel/zitadel/v2 to 4.12.0 or later.

go get github.com/zitadel/zitadel/v2@v4.12.0

Affected

Fixed versions

Sources

• osv: GHSA-pr34-2v5x-6qjq#Go/github.com/zitadel/zitadel/v2
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq
• https://nvd.nist.gov/vuln/detail/CVE-2026-29191
• https://github.com/zitadel/zitadel

CVE-2026-29191 · published 2026-03-04T22:47:08Z · modified 2026-03-23T04:56:25.187657306Z · JSON

Go/github.com/zitadel/zitadel CVE-2026-29191: unknown, EPSS 0.40%

ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint in github.com/zitadel/zitadel

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4607
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq

CVE-2026-29191 · published 2026-03-10T18:28:10Z · modified 2026-03-23T04:53:14.859341Z · JSON