Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-29191

9.3 CRITICAL

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): NONE

created 1 month, 1 week ago

ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

References

https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq x_refsource_CONFIRM

Affected products

zitadel

==>= 4.0.0, < 4.12.0

Matching in nixpkgs

pkgs.zitadel

Identity and access management platform

nixos-unstable 2.71.7
- nixpkgs-unstable 2.71.7
- nixos-unstable-small 2.71.7
nixos-25.11 2.71.7
- nixos-25.11-small 2.71.7
- nixpkgs-25.11-darwin 2.71.7

pkgs.zitadel-tools

Helper tools for zitadel

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-25.11 0.5.0
- nixos-25.11-small 0.5.0
- nixpkgs-25.11-darwin 0.5.0

Package maintainers

@nrabulinski Nikodem Rabuliński <1337-nix@nrab.lol>