Zitadel versions 4.0.0 through 4.11.1 contain a stored cross‑site scripting flaw in the login V2 interface that can be triggered through a malicious default URI redirect. The flaw allows an attacker to inject script that is stored and subsequently executed when the login page is rendered, potentially stealing session cookies or performing actions on behalf of the victim, resulting in account takeover.

The vulnerability affects Zitadel identity management platform versions 4.0.0 to 4.11.1. Zitadel 4.12.0 and later incorporate the fix and therefore are not affected.

The flaw has a CVSS score of 7.7, indicating high severity, but the EPSS score is below 1 %, meaning that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would need to embed a malicious redirect URI into the login flow; once the login page loads with this stored value, user browsers will execute the injected script. The attack path is user‑visible and does not require elevated privileges, relying solely on the victim interacting with the compromised login page.