A cross‑site scripting flaw exists in the login V2 interface of the Zitadel identity platform. An attacker who can inject a malicious script into the /saml‑post endpoint can force the victim’s browser to execute that script during authentication, enabling unauthorized access to the victim’s account. The vulnerability is identified as CWE‑79 and can potentially allow attackers to steal session cookies or otherwise hijack user credentials. The impact is a complete compromise of the affected user’s account, exposing all resources that the account can access.

The affected product is Zitadel, a free and open‑source identity management platform. Versions from 4.0.0 through 4.11.1 are vulnerable. The issue was addressed in version 4.12.0 and later.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests that, as of now, the risk of active exploitation is low. The vulnerability is not yet listed in the CISA KEV catalog. An attacker would need to deliver a crafted request to the /saml‑post endpoint, likely involving social engineering or a malicious link, to trigger the XSS. Once the script runs in the victim’s browser, the attacker can hijack the session and take over the account. The combination of high potential impact and low current exploitation probability still warrants prompt remediation.