CVE-2026-56667

Published: Jul 10, 2026Modified: Jul 10, 2026Deferred

7.3

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Exploitability: 1.0 / Impact: 5.8

Source: security-advisories@github.com (Secondary)

Description

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached. This issue is fixed in version 4.15.3.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/zitadel/zitadel/commit/038265925a3b05ac1df8aad461ab071983e9eb85

Source: security-advisories@github.com

https://github.com/zitadel/zitadel/releases/tag/v4.15.3

Source: security-advisories@github.com

https://github.com/zitadel/zitadel/security/advisories/GHSA-5wcj-9wj4-j65h

Source: security-advisories@github.com

Timeline

No history available yet.