7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29192

CVE-2026-29192: ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29192

CVE-2026-29192:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel/v2	go	>= 4.0.0, < 4.12.0	4.12.0
github.com/zitadel/zitadel	go	>= 4.0.0, < 4.12.0	4.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in ZITADEL's login interface that could lead to account takeover. The root cause was twofold:

Stored XSS via defaultRedirectUri: Organization administrators could configure a defaultRedirectUri. This URI was not properly sanitized before being used in a link's href attribute on the post-login page (/signedin). A malicious administrator could set this URI to a javascript: payload. When a user from that organization logged in, the malicious script would execute in their browser. The vulnerable function is the Page component in apps/login/src/app/(login)/signedin/page.tsx, which rendered this link without validation. The fix was introduced in commit f2d451a by adding the isSafeRedirectUri function to validate the URI and prevent malicious schemes.
Password Reset without Current Password: The account takeover was possible because the checkSessionAndSetPassword function allowed changing a password without providing the current one. It only checked if the user had recently authenticated. The XSS payload could be used to trigger this password change process for the logged-in user. The vulnerable function is checkSessionAndSetPassword in apps/login/src/lib/server/password.ts. The fix, implemented in commit 8509cc9, was to modify this function to always require the user's currentPassword for verification before allowing a change.

In summary, an attacker could store a malicious script that, when executed by a victim, would call the insecure password change function to take over the account. The patches address both the XSS vector and the insecure password reset logic.

Vulnerable functions

Page

apps/login/src/app/(login)/signedin/page.tsx

This Next.js page component is rendered after a user successfully logs in. It was responsible for rendering a 'Continue' button that redirects the user to a configured URL. The vulnerability lies in the fact that the `href` attribute of this link was set directly from the `defaultRedirectUri` setting of the organization, which could be controlled by an administrator. A malicious administrator could set a `javascript:` URI, which would then be rendered on this page and executed in the user's browser, leading to a stored Cross-Site Scripting (XSS) vulnerability.

checkSessionAndSetPassword

apps/login/src/lib/server/password.ts

This server-side function handled the logic for changing a user's password. Prior to the patch, it allowed a password change without requiring the current password, as long as the user had authenticated with their password within the last 5 minutes. An attacker could exploit the stored XSS vulnerability to make a request from the victim's browser to this endpoint, allowing them to reset the victim's password without knowing the original one, thus leading to account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.