Vulnerabilities CVE-2026-55671

CVE-2026-55671

Low

Open

TLP:CLEAR

ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to loopback, internal IP, link-local, or redirected endpoints through DNS rebinding, redirects, or protocol downgrades. This issue is fixed in version 4.15.2.

Details

CVSS Score: 2.3
EPSS Score ⓘ: 0.25%

16.7th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jul 10, 2026
Last Modified: Jul 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.