UpHeron
All vulnerabilities

Servers and applications

CVE-2024-29892

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with…

Severity
Medium 4.9
Published
27 Mar 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.43.11, 2.44.7, 2.45.5, 2.46.5, 2.47.8, 2.48.3
Sources
NVD

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.48.0 before 2.48.3
  • From 2.47.0 before 2.47.8
  • From 2.46.0 before 2.46.5
  • From 2.45.0 before 2.45.5
All 7 release lines
  • Every version before 2.42.17
  • From 2.43.0 before 2.43.11
  • From 2.44.0 before 2.44.7
  • From 2.45.0 before 2.45.5
  • From 2.46.0 before 2.46.5
  • From 2.47.0 before 2.47.8
  • From 2.48.0 before 2.48.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-29892
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-29892