GHSA-7777-fhq9-592v
NoneCVSS
—
EPSS
—
Published
Feb 27, 2026
CISA due date
—
The record
ZITADEL has potential SSRF via Actions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zitadel/zitadel/v2 | 0 | 1.80.0-v2.20.0.20260225053328-b2532e966621 |
| Go | github.com/zitadel/zitadel/v2 | 2.59.0 | 4.11.1 |
Related vulnerabilities
- CVE-2026-27945 ZITADEL is an open source identity management platform. Same vulnerability
- CVE-2026-29067 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel/v2
- GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in… Also affects github.com/zitadel/zitadel/v2
- GO-2025-4213 ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in… Also affects github.com/zitadel/zitadel/v2
- GO-2025-4212 ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login in… Also affects github.com/zitadel/zitadel/v2
- CVE-2025-67495 ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login Also affects github.com/zitadel/zitadel/v2
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login Also affects github.com/zitadel/zitadel/v2
- GO-2025-4084 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in… Also affects github.com/zitadel/zitadel/v2