Cyber Posture

CVE-2026-29192

High

Published: 07 March 2026

Published
07 March 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0001 3.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29192 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zitadel Zitadel. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2026-29192 by requiring timely identification, reporting, and patching of the flaw in ZITADEL's login V2 interface to prevent account takeover via default URI redirect.

prevent

Requires validation of information inputs such as redirect URIs in the login V2 interface, directly addressing the default URI redirect vulnerability that enables account takeover.

detect

Vulnerability scanning detects the CVE-2026-29192 flaw in affected ZITADEL versions, enabling proactive patching to prevent exploitation by high-privilege attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
Why these techniques?

Vuln in public login interface (T1190) of IAM platform enables account takeover via redirect URI abuse, directly facilitating use of valid/stolen accounts (T1078) and theft of issued access tokens (T1528).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.

Deeper analysisAI

CVE-2026-29192 is a vulnerability in the login V2 interface of ZITADEL, an open source identity management platform. Affecting versions 4.0.0 through 4.11.1, it enables a possible account takeover via Default URI Redirect and is associated with CWE-79. The issue carries a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), indicating network accessibility with high attack complexity and privileges required.

An attacker with high privileges can exploit this vulnerability over the network without user interaction. Successful exploitation allows scope-changed impacts, achieving high confidentiality and integrity effects, such as account takeover, while availability remains unaffected.

The GitHub Security Advisory (GHSA-6rx5-m2rc-hmf7) confirms the vulnerability and states that it has been patched in ZITADEL version 4.12.0. Security practitioners should upgrade to this version or later to mitigate the issue.

Details

CWE(s)

Affected Products

zitadel
zitadel
4.0.0 — 4.12.0

CVEs Like This One

CVE-2026-29191Same product: Zitadel Zitadel
CVE-2026-29193Same product: Zitadel Zitadel
CVE-2025-64103Same product: Zitadel Zitadel
CVE-2026-32130Same product: Zitadel Zitadel
CVE-2026-29067Same product: Zitadel Zitadel
CVE-2026-32132Same product: Zitadel Zitadel
CVE-2025-64717Same product: Zitadel Zitadel
CVE-2026-32131Same product: Zitadel Zitadel
CVE-2025-53895Same product: Zitadel Zitadel
CVE-2025-27507Same product: Zitadel Zitadel

References