CVE-2026-44671

high
Published 2026-05-14 · Modified 2026-05-15
CVSS v3
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2
VIR risk
7.5

Description

ZITADEL has LDAP Filter Injection in Login Flow

Predictions

Exploit likelihood
83%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/zitadel/zitadel/security/advisories/GHSA-rxvx-hhpj-q6px

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/zitadel/zitadel/releases/tag/v4.15.0

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/zitadel/zitadel/releases/tag/v3.4.10

Package impact

EcosystemPackageVulnerableFixed
golang Gogithub.com/zitadel/zitadel>=4.0.0,<4.15.04.15.0
golang Gogithub.com/zitadel/zitadel>=2.71.11,<=2.71.19
golang Gogithub.com/zitadel/zitadel>=3.1.0,<3.4.103.4.10
golang GOgithub.com/zitadel/zitadel>= 3.1.0, <= 3.4.93.4.10
golang GOgithub.com/zitadel/zitadel>= 2.71.11, <= 2.71.19
golang GOgithub.com/zitadel/zitadel>= 4.0.0, <= 4.14.04.15.0

Application impact

VendorProductVersionsFixed
zitadelzitadel{"startIncluding":"2.71.11","endExcluding":"3.4.10"}3.4.10

References

CWEs

CWE-90

Verify integrity in audit chain (admin only). AS-IS.