Technical impact
ZITADEL is an open‑source identity management platform. Before version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without performing the isSafeRedirectUri check. This omission permits an organization or instance administrator to store a javascript or data URI that will be executed in the user’s browser when the error path is triggered, resulting in stored cross‑site scripting. The flaw is a classic example of CWE‑79, The issue is fixed in version 4.15.3.
Affected Systems
Vendors: Zitadel, Product: Zitadel open‑source identity management platform. Versions prior to 4.15.3 are vulnerable. The vulnerability can only be exploited when an organization or instance administrator has set a custom loginSettings.defaultRedirectUri value that uses a javascript: or data: scheme. An affected user must subsequently trigger an OIDC or SAML FailedPrecondition error to be redirected to the malicious URI.
Risk and Exploitability
The CVSS score of 7.3 indicates a high‑severity stored cross‑site scripting flaw. EPSS is < a low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack path requires an administrator to URI and a user to trigger an error path, after which the stored script runs in the user’s browser. Exploitation depends on the application’s defaultRedirectUri value.
