CVE-2026-56667: ZITADEL: Stored XSS via Default URI Redirect in Login V2
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached. This issue is fixed in version 4.15.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZITADEL Login V2 (OIDC and SAML)to a version that resolves this vulnerability.Fixed in 4.15.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56667?
The severity of CVE-2026-56667 is high with a score of 7.3.
What vulnerability does CVE-2026-56667 identify?
CVE-2026-56667 identifies a stored XSS vulnerability in ZITADEL's Login V2 that allows attackers to redirect users to malicious URIs.
How do I fix CVE-2026-56667?
To fix CVE-2026-56667, upgrade ZITADEL to version 4.15.3 or later, where the vulnerability has been addressed.
Who is affected by CVE-2026-56667?
Organizations or instance administrators using ZITADEL Login V2 prior to version 4.15.3 are affected by CVE-2026-56667.
What is the impact of CVE-2026-56667?
The impact of CVE-2026-56667 allows an attacker to execute JavaScript in a user's browser through stored XSS.