Vulnerability Database · Go · Package report
github.com/zitadel/zitadel: vulnerability history, versions and safety
github.com/zitadel/zitadel is a package in the Go ecosystem. Vulert records 89 vulnerabilities for it across 120 releases, from Aug 2022 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
Vulert verdict on github.com/zitadel/zitadel v1.87.5 i
Updated on 23 Oct 2026
Careful: 30 of the 89 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.
- Security Unfixed issues
- Maintenance Sustainable
- Popularity Key ecosystem project
- Community Active
What to do: Plan around the 30 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Current release v1.87.5 — unaffected i
- Vulnerabilities on record 89 over 4 years · 54 in the last year i
- Latest disclosure 01 Oct 2026 i
- Highest CVSS 9.3 i
- With no published fix 30 i
- Stars 15,337 i
- Last release this month i
- Licence AGPL-3.0 i
Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for github.com/zitadel/zitadel, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- v1.80.0-v2.20.0.20261022191348-176e2ca2b1fe 22 Oct 2026
- v1.80.0-v2.20.0.20261022070544-8afa5dd37a8e 22 Oct 2026
- v1.80.0-v2.20.0.20261021125421-ce12560d2491 21 Oct 2026
- v1.80.0-v2.20.0.20261020171310-318278068a35 20 Oct 2026
- v1.80.0-v2.20.0.20261019125703-910522e4ce9b 19 Oct 2026
- v1.80.0-v2.20.0.20261016092946-5cd91e00d62f 16 Oct 2026
- v1.80.0-v2.20.0.20261016065113-269086148c8f 16 Oct 2026
- v1.80.0-v2.20.0.20261016051445-43adb800dcb0 16 Oct 2026
- v1.80.0-v2.20.0.20261015074342-a618740b5786 15 Oct 2026
- v1.80.0-v2.20.0.20261015073953-78cd78ace5f0 15 Oct 2026
- v1.80.0-v2.20.0.20261013094826-034041f7ffd5 13 Oct 2026
- v1.80.0-v2.20.0.20261012093836-1cce3e0cb8e5 12 Oct 2026
- v1.80.0-v2.20.0.20261009060154-ad835efbc3f6 09 Oct 2026
- v1.80.0-v2.20.0.20261006165909-8a54a2a0c611 06 Oct 2026
- v1.80.0-v2.20.0.20261002181527-ab3b44cd7437 02 Oct 2026
- v1.80.0-v2.20.0.20261001084427-101343ad87ae 01 Oct 2026
- v1.80.0-v2.20.0.20260929152635-73e0c0c30990 29 Sep 2026
- v1.80.0-v2.20.0.20260928042439-2c37c4176ad5 28 Sep 2026
- v0.0.0-20260925150532-5ca0b54ca311 25 Sep 2026
- v1.80.0-v2.20.0.20260925150532-5ca0b54ca311 25 Sep 2026
- v1.80.0-v2.20.0.20260924074023-20d79ca05e5c 24 Sep 2026
- v1.80.0-v2.20.0.20260923144736-76959769b902 23 Sep 2026
- v1.80.0-v2.20.0.20260923142050-bb7f8ee2fd95 23 Sep 2026
- v1.80.0-v2.20.0.20260923051709-765027e0d7fb 23 Sep 2026
- v1.80.0-v2.20.0.20260922153644-0a08e7269ac9 22 Sep 2026
- v1.80.0-v2.20.0.20260921170127-98272ab5d1c1 21 Sep 2026
- v1.80.0-v2.20.0.20260918130842-3ff4fbc7e4f2 18 Sep 2026
- v1.80.0-v2.20.0.20260917132047-9e1b85fa9189 17 Sep 2026
- v1.80.0-v2.20.0.20260911174753-8ccd5b206f3b 11 Sep 2026
- v1.80.0-v2.20.0.20260909160620-7e34f0436116 09 Sep 2026
- v1.80.0-v2.20.0.20260908131116-684de2e69127 08 Sep 2026
- v1.80.0-v2.20.0.20260907121409-8b87ca50d46d 07 Sep 2026
- v1.80.0-v2.20.0.20260904161509-13948f2bcd6f 04 Sep 2026
- v1.80.0-v2.20.0.20260904132632-8dac4e2b5462 04 Sep 2026
- v1.80.0-v2.20.0.20260904042810-41b11149c699 04 Sep 2026
- v1.80.0-v2.9.0.20260904042810-41b11149c699 04 Sep 2026
- v1.80.0-v2.20.0.20260904041337-9067605b667a 04 Sep 2026
- v1.80.0-v2.9.0.20260904035702-f3dcfa3db6d6 04 Sep 2026
- v1.80.0-v2.9.0.20260904034851-dbbab754207a 04 Sep 2026
- v1.80.0-v2.20.0.20260903040134-78be6183573c 03 Sep 2026
- v1.80.0-v2.9.0.20260903040134-78be6183573c 03 Sep 2026
- v1.80.0-v2.9.0.20260902104758-6515faa70c3d 02 Sep 2026
- v1.80.0-v2.20.0.20260902091125-ee133d0fa49b 02 Sep 2026
- v1.80.0-v2.9.0.20260902091125-ee133d0fa49b 02 Sep 2026
- v1.80.0-v2.20.0.20260901191237-3be21ccbf073 01 Sep 2026
- v1.80.0-v2.9.0.20260901191237-3be21ccbf073 01 Sep 2026
- v1.80.0-v2.9.0.20260901104222-43129c7ac2a8 01 Sep 2026
- v1.80.0-v2.9.0.20260831115745-5f9a5aa37fb6 31 Aug 2026
- v1.80.0-v2.9.0.20260831115642-da903d1a24a4 31 Aug 2026
- v1.80.0-v2.20.0.20260831083646-35aa21386339 31 Aug 2026
- v1.80.0-v2.9.0.20260831083646-35aa21386339 31 Aug 2026
- v1.80.0-v2.9.0.20260831083641-60a2195f458c 31 Aug 2026
- v1.80.0-v2.9.0.20260829001829-9654cf925a0b 29 Aug 2026
- v1.80.0-v2.9.0.20260829001827-c10896907def 29 Aug 2026
- v1.80.0-v2.9.0.20260829001609-c884eeb28949 29 Aug 2026
- v1.80.0-v2.9.0.20260829001607-e0969bd4d847 29 Aug 2026
- v1.80.0-v2.20.0.20260828182028-8de625dc4867 28 Aug 2026
- v1.80.0-v2.9.0.20260828182028-8de625dc4867 28 Aug 2026
- v1.80.0-v2.20.0.20260827201304-27ce10276b2e 27 Aug 2026
- v1.80.0-v2.20.0.20260827110730-3c746281f17f 27 Aug 2026
- v1.80.0-v2.20.0.20260825145843-6fdb74593c60 25 Aug 2026
- v1.80.0-v2.20.0.20260819063010-a1a4572303c5 19 Aug 2026
- v1.80.0-v2.20.0.20260817131708-d488ecb07ffe 17 Aug 2026
- v1.80.0-v2.20.0.20260814103305-632a5196800c 14 Aug 2026
- v0.0.0-20260814074120-d81ab1cf4e35 14 Aug 2026
- v1.80.0-v2.20.0.20260814074120-d81ab1cf4e35 14 Aug 2026
- v1.80.0-v2.20.0.20260814074119-67f9d2991913 14 Aug 2026
- v1.80.0-v2.20.0.20260814050005-a9311b8c7025 14 Aug 2026
- v1.80.0-v2.20.0.20260814042305-76dd58ecdf3b 14 Aug 2026
- v1.80.0-v2.20.0.20260814041139-8a61aa4f36b3 14 Aug 2026
- v1.80.0-v2.9.0.20260814041139-8a61aa4f36b3 14 Aug 2026
- v1.80.0-v2.20.0.20260812181220-5f3a0de33a16 12 Aug 2026
- v1.80.0-v2.20.0.20260812114158-a331e5b7ba69 12 Aug 2026
- v0.0.0-20260812080501-c2a55d2e6cec 12 Aug 2026
- v1.80.0-v2.20.0.20260812080501-c2a55d2e6cec 12 Aug 2026
- v1.80.0-v2.20.0.20260812073656-6127b567e77d 12 Aug 2026
- v1.80.0-v2.20.0.20260812060427-318bfc36d7a5 12 Aug 2026
- v0.0.0-20260811134415-2bd42e8fc4a6 11 Aug 2026
- v1.80.0-v2.20.0.20260811134415-2bd42e8fc4a6 11 Aug 2026
- v1.80.0-v2.20.0.20260810082734-30434d176cb3 10 Aug 2026
- v1.80.0-v2.20.0.20260807152356-83854e80e0b3 07 Aug 2026
- v0.0.0-20260803083759-9070b537d2eb 03 Aug 2026
- v1.80.0-v2.20.0.20260803083759-9070b537d2eb 03 Aug 2026
- v0.0.0-20260731093400-a8861336f465 31 Jul 2026
- v1.80.0-v2.20.0.20260731093400-a8861336f465 31 Jul 2026
- v1.80.0-v2.20.0.20260730144347-f34cc45eac5b 30 Jul 2026
- v1.80.0-v2.20.0.20260729133134-adb29746628b 29 Jul 2026
- v0.0.0-20260729062150-bab1099cc920 29 Jul 2026
- v1.80.0-v2.20.0.20260729062150-bab1099cc920 29 Jul 2026
- v1.80.0-v2.9.0.20260729042057-da677502e1d9 29 Jul 2026
- v1.80.0-v2.20.0.20260729041441-917ade35af9c 29 Jul 2026
- v1.80.0-v2.9.0.20260729041441-917ade35af9c 29 Jul 2026
- v1.80.0-v2.9.0.20260729041357-35122e43974d 29 Jul 2026
- v0.0.0-20260723081209-ca6595f8c592 23 Jul 2026
- v1.80.0-v2.20.0.20260723081209-ca6595f8c592 23 Jul 2026
- v1.80.0-v2.20.0.20260722114700-bb4f546b7cfd 22 Jul 2026
- v1.80.0-v2.20.0.20260717130948-3e94047da753 17 Jul 2026
- v1.80.0-v2.20.0.20260717074117-cc3812a940d6 17 Jul 2026
- v1.80.0-v2.20.0.20260717062356-56f4798ed31f 17 Jul 2026
- v1.80.0-v2.20.0.20260717062331-baf6ed501b68 17 Jul 2026
- v1.80.0-v2.20.0.20260714080509-aa76c3be27c6 14 Jul 2026
- v1.80.0-v2.9.0.20260714080509-aa76c3be27c6 14 Jul 2026
- v1.80.0-v2.20.0.20260709112809-9d60e83d6faa 09 Jul 2026
- v0.0.0-20260708104642-8b9d3637fdc4 08 Jul 2026
- v1.80.0-v2.20.0.20260708104642-8b9d3637fdc4 08 Jul 2026
- v1.80.0-v2.20.0.20260703142520-1beabed8cf68 03 Jul 2026
- v0.0.0-20260626080109-14874d654669 26 Jun 2026
- v1.80.0-v2.20.0.20260626080109-14874d654669 26 Jun 2026
- v1.80.0-v2.20.0.20260624172532-f96080a4c1ef 24 Jun 2026
- v1.80.0-v2.20.0.20260622094347-e2886a61670c 22 Jun 2026
- v1.80.0-v2.20.0.20260617043357-d1c3aa84af8f 17 Jun 2026
- v1.80.0-v2.20.0.20260617040551-c53d9774d427 17 Jun 2026
- v1.80.0-v2.20.0.20260616150900-10087e738970 16 Jun 2026
- v1.80.0-v2.20.0.20260616131956-0973b074b488 16 Jun 2026
- v1.80.0-v2.20.0.20260615140554-4925fab849d3 15 Jun 2026
- v1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2 15 Jun 2026
- v1.80.0-v2.20.0.20260615132747-d184e976fc79 15 Jun 2026
- v1.80.0-v2.20.0.20260615122908-fad02c6d9f45 15 Jun 2026
- v1.80.0-v2.20.0.20260615092437-6082e59d47c1 15 Jun 2026
- v1.80.0-v2.20.0.20260612121737-4459a1380c21 12 Jun 2026
The newest 120 of 1,070 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 54 of the 89 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for github.com/zitadel/zitadel
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| CVE-2026-29191: Zitadel 1-Click Account Takeover via XSS in /saml-post Endpoint | 9.3 critical | 4.12.0 | 04 Mar 2026 |
| CVE-2025-67494: ZITADEL Unauthenticated Full-Read SSRF Vulnerability | 9.3 critical | 1.80.0-v2.20.0.20251208091519-4c879b47334e | 08 Dec 2025 |
| CVE-2022-36051: Broken Authorization in ZITADEL Actions | 8.7 high | 2.2.0 | 30 Aug 2022 |
| ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass | 8.7 high | 2.42.17 | 28 Mar 2024 |
| CVE-2025-64431: ZITADEL Organization API IDOR Vulnerability Allows Cross-Tenant Data Tampering | 8.7 high | 4.6.3 | 05 Nov 2025 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
