Loading story…
ZITADEL, an identity and access management platform, has been found to contain critical vulnerabilities, including CVE-2025-67494 (CVSS 9.3) and CVE-2025-67495, that expose users to significant security risks. The flaws allow for server-side request forgery (SSRF), internal breaches, and account hijacking through DOM-based cross-site scripting (XSS) in the Zitadel V2 login interface. Successful exploitation could enable attackers to compromise user accounts and potentially gain unauthorized access to internal resources.
Security advisories highlight the severity of these issues, urging organizations using ZITADEL to apply patches and mitigations immediately. The vulnerabilities underscore the importance of robust input validation and prompt security updates in identity management solutions to prevent exploitation and protect sensitive authentication infrastructure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability report disclosed CVE-2025-67494 in ZITADEL, describing critical risks including SSRF that could lead to internal breach and XSS that could enable account hijacking. The report assigned the issue a CVSS score of 9.3.
A high-severity vulnerability affecting the ZITADEL V2 login flow was publicly reported as CVE-2025-67495. The DOM-based XSS issue was described as enabling account takeover and assigned a CVSS v3.1 score of 8.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity authorization flaw tracked as **CVE-2026-54693** allowed authenticated users of the **ZITADEL** identity management platform to obtain plaintext one-time verification codes during self-service profile changes. The bug affected backend authorization logic for email, phone, and human profile update paths, where multiple endpoints incorrectly hardcoded the `allowSelfManagement` permission flag to `true`. By sending profile update requests with the administrative `returnCode` parameter enabled, a user could receive the verification OTP directly in the JSON response instead of being required to control the target email address or phone number. The vulnerability affects ZITADEL versions **2.43.0 through 2.71.19**, **3.0.0-rc.1 through before 3.4.11**, and **4.0.0-rc.1 through before 4.15.1**. Security researchers said the flaw could let attackers claim ownership of email addresses or phone numbers they do not control and bypass email- or phone-based security policies. The issue is classified as **CWE-863 Incorrect Authorization**, is remotely exploitable, and carries a **CVSS 4.0 score of 8.2**. ZITADEL fixed the issue by changing the permission logic so `allowSelfManagement` is set dynamically to `false` whenever `returnCode` is `true`, with patched releases available in **3.4.11** and **4.15.1**.
Jul 29, 2026
Zimbra disclosed security updates for Zimbra Collaboration Suite (ZCS) Daffodil releases before `10.1.21`, addressing vulnerabilities that include **CVE-2026-93643**, a critical unauthenticated path-traversal flaw in the OnlyOffice/Document Editing integration. An attacker able to access an existing supported public Briefcase document can abuse unsigned save fields in a `/downloadas` request to write files through path traversal and execute commands as the `zimbra` user; the flaw is rated CVSS 9.8. Canadian and Guyanese national cyber authorities urged administrators to review Zimbra’s release information and apply the available update. Two additional unauthenticated stored XSS vulnerabilities, **CVE-2026-93642** and **CVE-2026-93647**, can let attackers execute script in authenticated users’ browsers and access mailbox data or act as those users. The first uses a forged share invitation accepted in Zimbra Modern, while the second embeds active markup in the `From` field of a calendar `COUNTER` message viewed in the Classic client. Rapid7 warned that weaknesses across Zimbra mail, document, and calendar functions can support business email compromise campaigns that manipulate the records employees use for decisions, creating coordinated fraudulent communications and complicating forensic investigation.
Sep 29, 2026
Zimbra released an emergency patch to address a critical Server-Side Request Forgery (SSRF) vulnerability affecting the chat proxy configuration in its Daffodil product. The vulnerability was identified in versions of Zimbra Daffodil prior to v10.1.12, prompting immediate action from the vendor. Security advisories highlighted the potential for attackers to exploit this flaw, which could allow unauthorized access to internal resources or sensitive information by manipulating the chat proxy configuration. The Canadian Centre for Cyber Security issued an alert (AV25-678) urging users and administrators to review the official Zimbra advisory and apply the necessary updates without delay. The emergency patch, included in Zimbra Daffodil version 10.1.12, was made available to mitigate the risk associated with this vulnerability. The flaw's critical nature raised concerns about the potential for remote exploitation, especially in environments where Zimbra's chat functionality is exposed to untrusted networks. Organizations relying on Zimbra for email and collaboration services were advised to prioritize patch deployment to prevent possible compromise. The vulnerability's disclosure and rapid patch release underscore the importance of timely vulnerability management in enterprise environments. Security experts noted that SSRF vulnerabilities can be leveraged to bypass network restrictions, access internal services, or facilitate further attacks. The Zimbra advisory provided technical details and guidance for administrators to verify successful patch application. No reports of active exploitation were mentioned at the time of the advisory, but the urgency of the patch suggests a high risk of exploitation if left unaddressed. The incident highlights the ongoing challenges faced by software vendors in securing complex collaboration platforms. Zimbra's response included not only the patch but also recommendations for monitoring and additional security best practices. The Cyber Centre's involvement reflects the vulnerability's significance for Canadian organizations and the broader global user base. Administrators were reminded to review their systems for signs of compromise and to ensure all relevant updates are applied promptly. The event serves as a reminder of the critical role of coordinated disclosure and rapid response in minimizing the impact of software vulnerabilities.
Jul 12, 2026