CVE-2026-56667: ZITADEL Login V2 XSS Vulnerability

CVE-2026-56667 Overview

CVE-2026-56667 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in ZITADEL, an open source identity management platform. In versions prior to 4.15.3, the ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri directly to router.push without invoking the isSafeRedirectUri check. An organization or instance administrator can store a javascript: or data: URI that executes in a victim's browser when the login flow reaches an affected error path.

Critical Impact
A privileged administrator can persist a malicious redirect URI that triggers arbitrary script execution in end-user browsers during OIDC or SAML login errors, enabling session compromise and account takeover.

Affected Products

ZITADEL Login V2 (OIDC flow) prior to 4.15.3
ZITADEL Login V2 (SAML flow) prior to 4.15.3
ZITADEL identity management platform (all deployments running the vulnerable Login V2 component)

Discovery Timeline

2026-07-10 - CVE-2026-56667 published to NVD
2026-07-10 - Last updated in NVD database
Fixed in - ZITADEL v4.15.3 release

Technical Details for CVE-2026-56667

Vulnerability Analysis

The vulnerability resides in the client-side response handler for the ZITADEL Login V2 application. When an OIDC or SAML flow returns a FailedPrecondition error, the handler reads loginSettings.defaultRedirectUri from server configuration and forwards it to Next.js router.push. Other redirect paths in the codebase route the URI through isSafeRedirectUri, which restricts schemes to safe HTTP or relative targets. The error paths omit this validation entirely.

Because defaultRedirectUri is configurable by organization and instance administrators, an attacker with administrative privileges can store a javascript: URI. When a user encounters the error condition, the browser navigates to the attacker-controlled URI and executes the embedded script in the ZITADEL login origin. The script inherits access to session cookies and authenticated state, enabling account takeover or credential theft.

Root Cause

Missing input validation on a stored, administrator-controlled configuration value. The isSafeRedirectUri guard was applied to primary success paths but not to the FailedPrecondition error branches in oidc.ts and saml.ts within the login application.

Attack Vector

Exploitation requires an authenticated administrator to write a malicious URI into the organization or instance defaultRedirectUri setting. A victim user must then initiate an OIDC or SAML login flow that reaches the vulnerable error path. User interaction is required, and attack complexity is high because the specific error precondition must be triggered.

typescript

// Security patch in apps/login/src/lib/client-utils.ts
// fix(login): guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths
  }

  if ("redirect" in response && response.redirect) {
-    router.push(response.redirect);
-    return true;
+    if (isSafeRedirectUri(response.redirect)) {
+      router.push(response.redirect);
+      return true;
+    } else {
+      console.warn("handleServerActionResponse: Blocked unsafe redirect URI:", response.redirect);
+      setError("Unsafe redirect URI was blocked");
+      return true;
+    }
  }

  if ("samlData" in response && response.samlData) {

Source: ZITADEL commit 0382659

Detection Methods for CVE-2026-56667

Indicators of Compromise

Organization or instance defaultRedirectUri values containing javascript:, data:, vbscript:, or other non-HTTP schemes.
Audit log entries showing administrator modifications to loginSettings.defaultRedirectUri from unexpected accounts or IP addresses.
Browser console errors or Content Security Policy violations reported during OIDC or SAML login attempts.

Detection Strategies

Query the ZITADEL configuration API or database for all defaultRedirectUri entries and validate they match the https:// or relative-path allowlist.
Review administrative audit logs for changes to login settings across all organizations, correlating with account provisioning and role assignment events.
Inspect web server and reverse-proxy logs for OIDC/SAML error responses immediately preceded or followed by anomalous client-side redirects.

Monitoring Recommendations

Alert on any write operation to loginSettings.defaultRedirectUri and require secondary review for values not matching the corporate URI allowlist.
Monitor for privilege escalation to instance or organization administrator roles, since exploitation depends on this access.
Deploy Content Security Policy headers with script-src restrictions and log CSP violation reports from the login origin.

How to Mitigate CVE-2026-56667

Immediate Actions Required

Upgrade ZITADEL to version 4.15.3 or later, which enforces isSafeRedirectUri on all redirect paths including FailedPrecondition handlers.
Audit all organization and instance defaultRedirectUri values and remove any entry using non-HTTP schemes.
Rotate active sessions and review administrator account activity for the period during which the vulnerable version was deployed.

Patch Information

The fix ships in ZITADEL v4.15.3. The patch imports isSafeRedirectUri from @/lib/client-utils into oidc.ts and saml.ts and wraps the router.push(response.redirect) call with the validation function. Unsafe URIs are blocked and surface a user-visible error instead of executing. Release notes and commit details are available in the ZITADEL v4.15.3 release and the GHSA-5wcj-9wj4-j65h advisory.

Workarounds

Restrict administrative access to login settings and enforce multi-factor authentication for all instance and organization administrators.
Set defaultRedirectUri to a fixed, trusted HTTPS URL controlled by the identity team, and monitor the value for drift.
Deploy a strict Content Security Policy on the login application that disallows inline scripts and non-HTTPS script sources.

bash

# Configuration example: verify installed ZITADEL version and upgrade
zitadel --version

# Docker upgrade example
docker pull ghcr.io/zitadel/zitadel:v4.15.3
docker stop zitadel && docker rm zitadel
docker run -d --name zitadel ghcr.io/zitadel/zitadel:v4.15.3 start

# Audit stored defaultRedirectUri values for unsafe schemes
grep -rEi 'defaultRedirectUri.*(javascript:|data:|vbscript:)' /etc/zitadel/