Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security Policy
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

domain

package

Go to main page

Versions in this module

v1

v1.87.5

Dec 20, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.87.4

Oct 19, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.87.3

Oct 19, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.87.2

Oct 18, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.87.1

Aug 24, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.87.0

Jul 29, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.86.0

Jul 18, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.85.0

Jul 7, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.5

Jun 21, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.4

Jun 7, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.3

Jun 1, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.2

May 24, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.1

May 20, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.84.0

May 11, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

Changes in this version

+ func ValidateDefaultRedirectURI(rawURL string) bool

type LoginPolicy

+ DefaultRedirectURI string

v1.83.7

May 5, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.83.6

May 2, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.83.5

Apr 29, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.83.4

Apr 28, 2022 GO-2024-2637 +12 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

Changes in this version

+ const AudSuffix

+ const AvatarAssetPath

+ const CssPath

+ const CssVariablesFileName

+ const Dark

+ const DomainClaimedMessageType

+ const FeatureActions

+ const FeatureCustomDomain

+ const FeatureCustomText

+ const FeatureCustomTextLogin

+ const FeatureCustomTextMessage

+ const FeatureLabelPolicy

+ const FeatureLabelPolicyPrivateLabel

+ const FeatureLabelPolicyWatermark

+ const FeatureLockoutPolicy

+ const FeatureLoginPolicy

+ const FeatureLoginPolicyFactors

+ const FeatureLoginPolicyIDP

+ const FeatureLoginPolicyPasswordReset

+ const FeatureLoginPolicyPasswordless

+ const FeatureLoginPolicyRegistration

+ const FeatureLoginPolicyUsernameLogin

+ const FeatureMetadata

+ const FeatureMetadataUser

+ const FeaturePasswordComplexityPolicy

+ const FeaturePrivacyPolicy

+ const IAMID

+ const IAMRolePrefix

+ const InitCodeMessageType

+ const LabelPolicyFontPath

+ const LabelPolicyIconPath

+ const LabelPolicyLogoPath

+ const LabelPolicyPrefix

+ const LoginCustomText

+ const LoginKeyEmailVerification

+ const LoginKeyEmailVerificationCodeLabel

+ const LoginKeyEmailVerificationDescription

+ const LoginKeyEmailVerificationDone

+ const LoginKeyEmailVerificationDoneCancelButtonText

+ const LoginKeyEmailVerificationDoneDescription

+ const LoginKeyEmailVerificationDoneLoginButtonText

+ const LoginKeyEmailVerificationDoneNextButtonText

+ const LoginKeyEmailVerificationDoneTitle

+ const LoginKeyEmailVerificationNextButtonText

+ const LoginKeyEmailVerificationResendButtonText

+ const LoginKeyEmailVerificationTitle

+ const LoginKeyExternalNotFound

+ const LoginKeyExternalNotFoundAutoRegisterButtonText

+ const LoginKeyExternalNotFoundDescription

+ const LoginKeyExternalNotFoundLinkButtonText

+ const LoginKeyExternalNotFoundPrivacyLinkText

+ const LoginKeyExternalNotFoundTOSAndPrivacyLabel

+ const LoginKeyExternalNotFoundTOSConfirm

+ const LoginKeyExternalNotFoundTOSConfirmAnd

+ const LoginKeyExternalNotFoundTOSLinkText

+ const LoginKeyExternalNotFoundTitle

+ const LoginKeyExternalRegistrationUserOverview

+ const LoginKeyExternalRegistrationUserOverviewBackButtonText

+ const LoginKeyExternalRegistrationUserOverviewDescription

+ const LoginKeyExternalRegistrationUserOverviewEmailLabel

+ const LoginKeyExternalRegistrationUserOverviewFirstnameLabel

+ const LoginKeyExternalRegistrationUserOverviewLanguageLabel

+ const LoginKeyExternalRegistrationUserOverviewLastnameLabel

+ const LoginKeyExternalRegistrationUserOverviewNextButtonText

+ const LoginKeyExternalRegistrationUserOverviewNicknameLabel

+ const LoginKeyExternalRegistrationUserOverviewPhoneLabel

+ const LoginKeyExternalRegistrationUserOverviewPrivacyLinkText

+ const LoginKeyExternalRegistrationUserOverviewTOSAndPrivacyLabel

+ const LoginKeyExternalRegistrationUserOverviewTOSConfirm

+ const LoginKeyExternalRegistrationUserOverviewTOSConfirmAnd

+ const LoginKeyExternalRegistrationUserOverviewTOSLinkText

+ const LoginKeyExternalRegistrationUserOverviewTitle

+ const LoginKeyExternalRegistrationUserOverviewUsernameLabel

+ const LoginKeyFooter

+ const LoginKeyFooterHelp

+ const LoginKeyFooterPrivacyPolicy

+ const LoginKeyFooterTOS

+ const LoginKeyInitMFADone

+ const LoginKeyInitMFADoneCancelButtonText

+ const LoginKeyInitMFADoneDescription

+ const LoginKeyInitMFADoneNextButtonText

+ const LoginKeyInitMFADoneTitle

+ const LoginKeyInitMFAOTP

+ const LoginKeyInitMFAOTPCancelButtonText

+ const LoginKeyInitMFAOTPCodeLabel

+ const LoginKeyInitMFAOTPDescription

+ const LoginKeyInitMFAOTPDescriptionOTP

+ const LoginKeyInitMFAOTPNextButtonText

+ const LoginKeyInitMFAOTPSecretLabel

+ const LoginKeyInitMFAOTPTitle

+ const LoginKeyInitMFAPrompt

+ const LoginKeyInitMFAPromptDescription

+ const LoginKeyInitMFAPromptNextButtonText

+ const LoginKeyInitMFAPromptOTPOption

+ const LoginKeyInitMFAPromptSkipButtonText

+ const LoginKeyInitMFAPromptTitle

+ const LoginKeyInitMFAPromptU2FOption

+ const LoginKeyInitMFAU2F

+ const LoginKeyInitMFAU2FDescription

+ const LoginKeyInitMFAU2FErrorRetry

+ const LoginKeyInitMFAU2FNotSupported

+ const LoginKeyInitMFAU2FRegisterTokenButtonText

+ const LoginKeyInitMFAU2FTitle

+ const LoginKeyInitMFAU2FTokenNameLabel

+ const LoginKeyInitPassword

+ const LoginKeyInitPasswordCodeLabel

+ const LoginKeyInitPasswordDescription

+ const LoginKeyInitPasswordDone

+ const LoginKeyInitPasswordDoneCancelButtonText

+ const LoginKeyInitPasswordDoneDescription

+ const LoginKeyInitPasswordDoneNextButtonText

+ const LoginKeyInitPasswordDoneTitle

+ const LoginKeyInitPasswordNewPasswordConfirmLabel

+ const LoginKeyInitPasswordNewPasswordLabel

+ const LoginKeyInitPasswordNextButtonText

+ const LoginKeyInitPasswordResendButtonText

+ const LoginKeyInitPasswordTitle

+ const LoginKeyInitUserDone

+ const LoginKeyInitUserDoneCancelButtonText

+ const LoginKeyInitUserDoneDescription

+ const LoginKeyInitUserDoneNextButtonText

+ const LoginKeyInitUserDoneTitle

+ const LoginKeyInitializeUser

+ const LoginKeyInitializeUserCodeLabel

+ const LoginKeyInitializeUserDescription

+ const LoginKeyInitializeUserNewPasswordConfirmLabel

+ const LoginKeyInitializeUserNewPasswordLabel

+ const LoginKeyInitializeUserNextButtonText

+ const LoginKeyInitializeUserResendButtonText

+ const LoginKeyInitializeUserTitle

+ const LoginKeyLinkingUserDone

+ const LoginKeyLinkingUserDoneCancelButtonText

+ const LoginKeyLinkingUserDoneDescription

+ const LoginKeyLinkingUserDoneNextButtonText

+ const LoginKeyLinkingUserDoneTitle

+ const LoginKeyLogin

+ const LoginKeyLoginDescription

+ const LoginKeyLoginDescriptionLinkingProcess

+ const LoginKeyLoginExternalUserDescription

+ const LoginKeyLoginLoginnamePlaceHolder

+ const LoginKeyLoginNameLabel

+ const LoginKeyLoginNextButtonText

+ const LoginKeyLoginRegisterButtonText

+ const LoginKeyLoginTitle

+ const LoginKeyLoginTitleLinkingProcess

+ const LoginKeyLoginUserMustBeMemberOfOrg

+ const LoginKeyLoginUsernamePlaceHolder

+ const LoginKeyLogoutDone

+ const LoginKeyLogoutDoneDescription

+ const LoginKeyLogoutDoneLoginButtonText

+ const LoginKeyLogoutDoneTitle

+ const LoginKeyMFAProviders

+ const LoginKeyMFAProvidersChooseOther

+ const LoginKeyMFAProvidersOTP

+ const LoginKeyMFAProvidersU2F

+ const LoginKeyPassword

+ const LoginKeyPasswordBackButtonText

+ const LoginKeyPasswordChange

+ const LoginKeyPasswordChangeCancelButtonText

+ const LoginKeyPasswordChangeDescription

+ const LoginKeyPasswordChangeDone

+ const LoginKeyPasswordChangeDoneDescription

+ const LoginKeyPasswordChangeDoneNextButtonText

+ const LoginKeyPasswordChangeDoneTitle

+ const LoginKeyPasswordChangeNewPasswordConfirmLabel

+ const LoginKeyPasswordChangeNewPasswordLabel

+ const LoginKeyPasswordChangeNextButtonText

+ const LoginKeyPasswordChangeOldPasswordLabel

+ const LoginKeyPasswordChangeTitle

+ const LoginKeyPasswordConfirmation

+ const LoginKeyPasswordDescription

+ const LoginKeyPasswordHasLowercase

+ const LoginKeyPasswordHasNumber

+ const LoginKeyPasswordHasSymbol

+ const LoginKeyPasswordHasUppercase

+ const LoginKeyPasswordLabel

+ const LoginKeyPasswordMinLength

+ const LoginKeyPasswordNextButtonText

+ const LoginKeyPasswordResetDone

+ const LoginKeyPasswordResetDoneDescription

+ const LoginKeyPasswordResetDoneNextButtonText

+ const LoginKeyPasswordResetDoneTitle

+ const LoginKeyPasswordResetLinkText

+ const LoginKeyPasswordTitle

+ const LoginKeyPasswordless

+ const LoginKeyPasswordlessDescription

+ const LoginKeyPasswordlessErrorRetry

+ const LoginKeyPasswordlessLoginWithPwButtonText

+ const LoginKeyPasswordlessNotSupported

+ const LoginKeyPasswordlessPrompt

+ const LoginKeyPasswordlessPromptDescription

+ const LoginKeyPasswordlessPromptDescriptionInit

+ const LoginKeyPasswordlessPromptNextButtonText

+ const LoginKeyPasswordlessPromptPasswordlessButtonText

+ const LoginKeyPasswordlessPromptSkipButtonText

+ const LoginKeyPasswordlessPromptTitle

+ const LoginKeyPasswordlessRegistration

+ const LoginKeyPasswordlessRegistrationDescription

+ const LoginKeyPasswordlessRegistrationDone

+ const LoginKeyPasswordlessRegistrationDoneCancelButtonText

+ const LoginKeyPasswordlessRegistrationDoneDescription

+ const LoginKeyPasswordlessRegistrationDoneDescriptionClose

+ const LoginKeyPasswordlessRegistrationDoneNextButtonText

+ const LoginKeyPasswordlessRegistrationDoneTitle

+ const LoginKeyPasswordlessRegistrationErrorRetry

+ const LoginKeyPasswordlessRegistrationNotSupported

+ const LoginKeyPasswordlessRegistrationRegisterTokenButtonText

+ const LoginKeyPasswordlessRegistrationTitle

+ const LoginKeyPasswordlessRegistrationTokenNameLabel

+ const LoginKeyPasswordlessTitle

+ const LoginKeyPasswordlessValidateTokenButtonText

+ const LoginKeyRegisterOrgDescription

+ const LoginKeyRegisterOrgEmailLabel

+ const LoginKeyRegisterOrgFirstnameLabel

+ const LoginKeyRegisterOrgLastnameLabel

+ const LoginKeyRegisterOrgOrgNameLabel

+ const LoginKeyRegisterOrgPasswordConfirmLabel

+ const LoginKeyRegisterOrgPasswordLabel

+ const LoginKeyRegisterOrgPrivacyLinkText

+ const LoginKeyRegisterOrgSaveButtonText

+ const LoginKeyRegisterOrgTOSAndPrivacyLabel

+ const LoginKeyRegisterOrgTOSConfirm

+ const LoginKeyRegisterOrgTOSLinkText

+ const LoginKeyRegisterOrgTitle

+ const LoginKeyRegisterOrgTosConfirmAnd

+ const LoginKeyRegisterOrgUsernameLabel

+ const LoginKeyRegistrationOption

+ const LoginKeyRegistrationOptionDescription

+ const LoginKeyRegistrationOptionExternalLoginDescription

+ const LoginKeyRegistrationOptionTitle

+ const LoginKeyRegistrationOptionUserNameButtonText

+ const LoginKeyRegistrationOrg

+ const LoginKeyRegistrationUser

+ const LoginKeyRegistrationUserBackButtonText

+ const LoginKeyRegistrationUserDescription

+ const LoginKeyRegistrationUserDescriptionOrgRegister

+ const LoginKeyRegistrationUserEmailLabel

+ const LoginKeyRegistrationUserFirstnameLabel

+ const LoginKeyRegistrationUserGenderLabel

+ const LoginKeyRegistrationUserLanguageLabel

+ const LoginKeyRegistrationUserLastnameLabel

+ const LoginKeyRegistrationUserNextButtonText

+ const LoginKeyRegistrationUserPasswordConfirmLabel

+ const LoginKeyRegistrationUserPasswordLabel

+ const LoginKeyRegistrationUserPrivacyLinkText

+ const LoginKeyRegistrationUserTOSAndPrivacyLabel

+ const LoginKeyRegistrationUserTOSConfirm

+ const LoginKeyRegistrationUserTOSConfirmAnd

+ const LoginKeyRegistrationUserTOSLinkText

+ const LoginKeyRegistrationUserTitle

+ const LoginKeyRegistrationUserUsernameLabel

+ const LoginKeySelectAccount

+ const LoginKeySelectAccountDescription

+ const LoginKeySelectAccountDescriptionLinkingProcess

+ const LoginKeySelectAccountOtherUser

+ const LoginKeySelectAccountSessionStateActive

+ const LoginKeySelectAccountSessionStateInactive

+ const LoginKeySelectAccountTitle

+ const LoginKeySelectAccountTitleLinkingProcess

+ const LoginKeySelectAccountUserMustBeMemberOfOrg

+ const LoginKeySuccessLogin

+ const LoginKeySuccessLoginAutoRedirectDescription

+ const LoginKeySuccessLoginNextButtonText

+ const LoginKeySuccessLoginRedirectedDescription

+ const LoginKeySuccessLoginTitle

+ const LoginKeyUsernameChange

+ const LoginKeyUsernameChangeCancelButtonText

+ const LoginKeyUsernameChangeDescription

+ const LoginKeyUsernameChangeDone

+ const LoginKeyUsernameChangeDoneDescription

+ const LoginKeyUsernameChangeDoneNextButtonText

+ const LoginKeyUsernameChangeDoneTitle

+ const LoginKeyUsernameChangeNextButtonText

+ const LoginKeyUsernameChangeTitle

+ const LoginKeyUsernameChangeUsernameLabel

+ const LoginKeyVerifyMFAOTP

+ const LoginKeyVerifyMFAOTPCodeLabel

+ const LoginKeyVerifyMFAOTPDescription

+ const LoginKeyVerifyMFAOTPNextButtonText

+ const LoginKeyVerifyMFAOTPTitle

+ const LoginKeyVerifyMFAU2F

+ const LoginKeyVerifyMFAU2FDescription

+ const LoginKeyVerifyMFAU2FErrorRetry

+ const LoginKeyVerifyMFAU2FNotSupported

+ const LoginKeyVerifyMFAU2FTitle

+ const LoginKeyVerifyMFAU2FValidateTokenText

+ const MessageButtonText

+ const MessageFooterText

+ const MessageGreeting

+ const MessagePreHeader

+ const MessageSubject

+ const MessageText

+ const MessageTitle

+ const OrgDomainPrimaryClaim

+ const OrgDomainPrimaryScope

+ const OrgRolePrefix

+ const PasswordResetMessageType

+ const PasswordlessRegistrationMessageType

+ const ProjectGrantRolePrefix

+ const ProjectIDScope

+ const ProjectRolePrefix

+ const RoleIAMOwner

+ const RoleOrgOwner

+ const RoleOrgProjectCreator

+ const RoleProjectOwner

+ const RoleProjectOwnerGlobal

+ const RoleSelfManagementGlobal

+ const UsersAssetPath

+ const VerifyEmailMessageType

+ const VerifyPhoneMessageType

+ func AddAudScopeToAudience(audience, scopes []string) []string

+ func AssetURL(prefix, resourceOwner, key string) string

+ func AvatarURL(prefix, resourceOwner, key string) string

+ func CheckForInvalidRoles(roles []string, rolePrefix string, validRoles []authz.RoleMapping) []string

+ func CheckRedirectUrisCode(compliance *Compliance, appType OIDCApplicationType, redirectUris []string)

+ func CheckRedirectUrisImplicit(compliance *Compliance, appType OIDCApplicationType, redirectUris []string)

+ func CheckRedirectUrisImplicitAndCode(compliance *Compliance, appType OIDCApplicationType, redirectUris []string)

+ func EnsureValidExpirationDate(key expiration) error

+ func FromRefreshToken(refreshToken string, algorithm crypto.EncryptionAlgorithm) (userID, tokenID, token string, err error)

+ func GenerateLoginName(username, domain string, appendDomain bool) string

+ func GetHumanAvatarAssetPath(userID string) string

+ func GetOIDCV1NativeApplicationCompliance(compliance *Compliance, authMethod OIDCAuthMethodType)

+ func GetOIDCV1UserAgentApplicationCompliance(compliance *Compliance, authMethod OIDCAuthMethodType)

+ func GetRemovedRoles(existingRoles, newRoles []string) []string

+ func IsMessageTextType(textType string) bool

+ func IsPrompt(prompt []Prompt, requestedPrompt Prompt) bool

+ func NewAuthNKeyPair(keySize int) (privateKey, publicKey []byte, err error)

+ func NewClientSecret(generator crypto.Generator) (*crypto.CryptoValue, string, error)

+ func NewIAMDomainName(orgName, iamDomain string) string

+ func NewOTPKey(issuer, accountName string, cryptoAlg crypto.EncryptionAlgorithm) (*otp.Key, *crypto.CryptoValue, error)

+ func NewRefreshToken(userID, tokenID string, algorithm crypto.EncryptionAlgorithm) (string, error)

+ func OIDCOriginAllowList(redirectURIs, additionalOrigins []string) ([]string, error)

+ func PasswordlessInitCodeLink(baseURL, userID, resourceOwner, codeID, code string) string

+ func RefreshToken(userID, tokenID, token string, algorithm crypto.EncryptionAlgorithm) (string, error)

+ func SetNewAuthNKeyPair(key authNKey, keySize int) error

+ func SetNewClientID(a oAuthApplication, idGenerator id.Generator, project *Project) error

+ func SetNewClientSecretIfNeeded(a oAuthApplication, generator crypto.Generator) (string, error)

+ func ValidateExpirationDate(date time.Time) (time.Time, error)

+ func VerifyMFAOTP(code string, secret *crypto.CryptoValue, cryptoAlg crypto.EncryptionAlgorithm) error

+ type APIApp struct

+ AppID string

+ AppName string

+ AuthMethodType APIAuthMethodType

+ ClientID string

+ ClientSecret *crypto.CryptoValue

+ ClientSecretString string

+ State AppState

+ func (a *APIApp) GenerateClientSecretIfNeeded(generator crypto.Generator) (secret string, err error)

+ func (a *APIApp) GetApplicationName() string

+ func (a *APIApp) GetState() AppState

+ func (a *APIApp) IsValid() bool

+ type APIAuthMethodType int32

+ const APIAuthMethodTypeBasic

+ const APIAuthMethodTypePrivateKeyJWT

+ type Action struct

+ AllowedToFail bool

+ Name string

+ Script string

+ State ActionState

+ Timeout time.Duration

+ func (a *Action) IsValid() bool

+ type ActionState int32

+ const ActionStateActive

+ const ActionStateInactive

+ const ActionStateRemoved

+ const ActionStateUnspecified

+ func (s ActionState) Exists() bool

+ func (s ActionState) Valid() bool

+ type ActionsAllowed int32

+ const ActionsAllowedUnlimited

+ const ActionsMaxAllowed

+ const ActionsNotAllowed

+ type Address struct

+ Country string

+ Locality string

+ PostalCode string

+ Region string

+ StreetAddress string

+ type AddressState int32

+ const AddressStateActive

+ const AddressStateRemoved

+ const AddressStateUnspecified

+ func (s AddressState) Valid() bool

+ type AppState int32

+ const AppStateActive

+ const AppStateInactive

+ const AppStateRemoved

+ const AppStateUnspecified

+ func (a AppState) Exists() bool

+ type Application interface

+ GetAppID func() string

+ GetApplicationName func() string

+ GetState func() AppState

+ type ApplicationKey struct

+ ApplicationID string

+ ClientID string

+ ExpirationDate time.Time

+ KeyID string

+ PrivateKey []byte

+ PublicKey []byte

+ Type AuthNKeyType

+ func (k *ApplicationKey) Detail() ([]byte, error)

+ func (k *ApplicationKey) MarshalJSON() ([]byte, error)

+ type AssetInfo struct

+ AutheticatedURL string

+ Bucket string

+ ContentType string

+ ETag string

+ Expiration time.Time

+ Key string

+ LastModified time.Time

+ Location string

+ Size int64

+ VersionID string

+ type AuthNKeyType int32

+ const AuthNKeyTypeJSON

+ const AuthNKeyTypeNONE

+ func (k AuthNKeyType) Valid() bool

+ type AuthRequest struct

+ AgentID string

+ AllowedExternalIDPs []*IDPProvider

+ ApplicationID string

+ ApplicationResourceOwner string

+ Audience []string

+ AuthTime time.Time

+ AvatarKey string

+ BrowserInfo *BrowserInfo

+ CallbackURI string

+ ChangeDate time.Time

+ Code string

+ CreationDate time.Time

+ DefaultTranslations []*CustomText

+ DisplayName string

+ ID string

+ LabelPolicy *LabelPolicy

+ LinkingUsers []*ExternalUser

+ LockoutPolicy *LockoutPolicy

+ LoginHint string

+ LoginName string

+ LoginPolicy *LoginPolicy

+ MFAsVerified []MFAType

+ MaxAuthAge *time.Duration

+ OrgTranslations []*CustomText

+ PasswordVerified bool

+ PossibleLOAs []LevelOfAssurance

+ PossibleSteps []NextStep

+ PresignedAvatar string

+ PrivacyPolicy *PrivacyPolicy

+ PrivateLabelingSetting PrivateLabelingSetting

+ Prompt []Prompt

+ Request Request

+ RequestedOrgID string

+ RequestedOrgName string

+ RequestedPrimaryDomain string

+ SelectedIDPConfigID string

+ TransferState string

+ UiLocales []string

+ UserID string

+ UserName string

+ UserOrgID string

+ func NewAuthRequestFromType(requestType AuthRequestType) (*AuthRequest, error)

+ func (a *AuthRequest) AppendAudIfNotExisting(aud string)

+ func (a *AuthRequest) GetScopeOrgPrimaryDomain() string

+ func (a *AuthRequest) GetScopeProjectIDsForAud() []string

+ func (a *AuthRequest) MFALevel() MFALevel

+ func (a *AuthRequest) SetUserInfo(userID, userName, loginName, displayName, avatar, userOrgID string)

+ func (a *AuthRequest) WithCurrentInfo(info *BrowserInfo) *AuthRequest

+ type AuthRequestOIDC struct

+ CodeChallenge *OIDCCodeChallenge

+ Nonce string

+ ResponseType OIDCResponseType

+ Scopes []string

+ func (a *AuthRequestOIDC) IsValid() bool

+ func (a *AuthRequestOIDC) Type() AuthRequestType

+ type AuthRequestSAML struct

+ func (a *AuthRequestSAML) IsValid() bool

+ func (a *AuthRequestSAML) Type() AuthRequestType

+ type AuthRequestType int32

+ const AuthRequestTypeOIDC

+ const AuthRequestTypeSAML

+ type AuthenticatorAttachment int32

+ const AuthenticatorAttachmentCrossPlattform

+ const AuthenticatorAttachmentPlattform

+ const AuthenticatorAttachmentUnspecified

+ type BrowserInfo struct

+ AcceptLanguage string

+ RemoteIP net.IP

+ UserAgent string

+ func BrowserInfoFromRequest(r *net_http.Request) *BrowserInfo

+ type BucketInfo struct

+ CreationDate time.Time

+ Name string

+ type ChangeApp struct

+ AppID string

+ AppName string

+ State AppState

+ func (a *ChangeApp) GetAppID() string

+ func (a *ChangeApp) GetApplicationName() string

+ func (a *ChangeApp) GetState() AppState

+ type ChangePasswordStep struct

+ func (s *ChangePasswordStep) Type() NextStepType

+ type ChangeUsernameStep struct

+ func (s *ChangeUsernameStep) Type() NextStepType

+ type Compliance struct

+ NoneCompliant bool

+ Problems []string

+ func GetOIDCCompliance(version OIDCVersion, appType OIDCApplicationType, grantTypes []OIDCGrantType, ...) *Compliance

+ func GetOIDCV1Compliance(appType OIDCApplicationType, grantTypes []OIDCGrantType, ...) *Compliance

+ type CustomLoginText struct

+ Default bool

+ EmailVerification EmailVerificationScreenText

+ EmailVerificationDone EmailVerificationDoneScreenText

+ ExternalNotFoundOption ExternalUserNotFoundScreenText

+ ExternalRegistrationUserOverview ExternalRegistrationUserOverviewScreenText

+ Footer FooterText

+ InitMFADone InitMFADoneScreenText

+ InitMFAOTP InitMFAOTPScreenText

+ InitMFAPrompt InitMFAPromptScreenText

+ InitMFAU2F InitMFAU2FScreenText

+ InitPassword InitPasswordScreenText

+ InitPasswordDone InitPasswordDoneScreenText

+ InitUser InitializeUserScreenText

+ InitUserDone InitializeUserDoneScreenText

+ IsDefault bool

+ Language language.Tag

+ LinkingUsersDone LinkingUserDoneScreenText

+ Login LoginScreenText

+ LoginSuccess SuccessLoginScreenText

+ LogoutDone LogoutDoneScreenText

+ MFAProvider MFAProvidersText

+ Password PasswordScreenText

+ PasswordChange PasswordChangeScreenText

+ PasswordChangeDone PasswordChangeDoneScreenText

+ PasswordResetDone PasswordResetDoneScreenText

+ Passwordless PasswordlessScreenText

+ PasswordlessPrompt PasswordlessPromptScreenText

+ PasswordlessRegistration PasswordlessRegistrationScreenText

+ PasswordlessRegistrationDone PasswordlessRegistrationDoneScreenText

+ RegisterOption RegistrationOptionScreenText

+ RegistrationOrg RegistrationOrgScreenText

+ RegistrationUser RegistrationUserScreenText

+ SelectAccount SelectAccountScreenText

+ State PolicyState

+ UsernameChange UsernameChangeScreenText

+ UsernameChangeDone UsernameChangeDoneScreenText

+ VerifyMFAOTP VerifyMFAOTPScreenText

+ VerifyMFAU2F VerifyMFAU2FScreenText

+ func (m *CustomLoginText) IsValid() bool

+ type CustomMessageText struct

+ ButtonText string

+ Default bool

+ FooterText string

+ Greeting string

+ Language language.Tag

+ MessageTextType string

+ PreHeader string

+ State PolicyState

+ Subject string

+ Text string

+ Title string

+ func (m *CustomMessageText) IsValid() bool

+ type CustomText struct

+ Default bool

+ Key string

+ Language language.Tag

+ State CustomTextState

+ Template string

+ Text string

+ func (m *CustomText) IsValid() bool

+ type CustomTextState int32

+ const CustomTextStateActive

+ const CustomTextStateRemoved

+ const CustomTextStateUnspecified

+ type Email struct

+ EmailAddress string

+ IsEmailVerified bool

+ func (e *Email) IsValid() bool

+ type EmailCode struct

+ Code *crypto.CryptoValue

+ Expiry time.Duration

+ func NewEmailCode(emailGenerator crypto.Generator) (*EmailCode, error)

+ type EmailVerificationDoneScreenText struct

+ CancelButtonText string

+ Description string

+ LoginButtonText string

+ NextButtonText string

+ Title string

+ type EmailVerificationScreenText struct

+ CodeLabel string

+ Description string

+ NextButtonText string

+ ResendButtonText string

+ Title string

+ type ExternalLoginStep struct

+ SelectedIDPConfigID string

+ func (s *ExternalLoginStep) Type() NextStepType

+ type ExternalNotFoundOptionStep struct

+ func (s *ExternalNotFoundOptionStep) Type() NextStepType

+ type ExternalRegistrationUserOverviewScreenText struct

+ BackButtonText string

+ Description string

+ EmailLabel string

+ FirstnameLabel string

+ LanguageLabel string

+ LastnameLabel string

+ NextButtonText string

+ NicknameLabel string

+ PhoneLabel string

+ PrivacyLinkText string

+ TOSAndPrivacyLabel string

+ TOSConfirm string

+ TOSConfirmAnd string

+ TOSLinkText string

+ Title string

+ UsernameLabel string

+ type ExternalUser struct

+ DisplayName string

+ Email string

+ ExternalUserID string

+ FirstName string

+ IDPConfigID string

+ IsEmailVerified bool

+ IsPhoneVerified bool

+ LastName string

+ Metadatas []*Metadata

+ NickName string

+ Phone string

+ PreferredLanguage language.Tag

+ PreferredUsername string

+ type ExternalUserNotFoundScreenText struct

+ AutoRegisterButtonText string

+ Description string

+ LinkButtonText string

+ PrivacyLinkText string

+ TOSAndPrivacyLabel string

+ TOSConfirm string

+ TOSConfirmAnd string

+ TOSLinkText string

+ Title string

+ type FactorState int32

+ const FactorStateActive

+ const FactorStateRemoved

+ const FactorStateUnspecified

+ func (f FactorState) Valid() bool

+ type Features struct

+ ActionsAllowed ActionsAllowed

+ AuditLogRetention time.Duration

+ CustomDomain bool

+ CustomTextLogin bool

+ CustomTextMessage bool

+ IsDefault bool

+ LabelPolicyPrivateLabel bool

+ LabelPolicyWatermark bool

+ LockoutPolicy bool

+ LoginPolicyFactors bool

+ LoginPolicyIDP bool

+ LoginPolicyPasswordReset bool

+ LoginPolicyPasswordless bool

+ LoginPolicyRegistration bool

+ LoginPolicyUsernameLogin bool

+ MaxActions int

+ MetadataUser bool

+ PasswordComplexityPolicy bool

+ PrivacyPolicy bool

+ State FeaturesState

+ StateDescription string

+ TierDescription string

+ TierName string

+ type FeaturesState int32

+ const FeaturesStateActionRequired

+ const FeaturesStateActive

+ const FeaturesStateCanceled

+ const FeaturesStateGrandfathered

+ const FeaturesStateRemoved

+ const FeaturesStateUnspecified

+ func (f FeaturesState) Valid() bool

+ type FlowState int32

+ const FlowStateActive

+ const FlowStateInactive

+ func (s FlowState) Valid() bool

+ type FlowType int32

+ const FlowTypeExternalAuthentication

+ const FlowTypeUnspecified

+ func (s FlowType) HasTrigger(triggerType TriggerType) bool

+ func (s FlowType) Valid() bool

+ type FooterText struct

+ Help string

+ PrivacyPolicy string

+ TOS string

+ type Gender int32

+ const GenderDiverse

+ const GenderFemale

+ const GenderMale

+ const GenderUnspecified

+ func (f Gender) Specified() bool

+ func (f Gender) Valid() bool

+ type GrantRequiredStep struct

+ func (s *GrantRequiredStep) Type() NextStepType

+ type Human struct

+ State UserState

+ Username string

+ func (h Human) GetState() UserState

+ func (h Human) GetUsername() string

+ func (u *Human) CheckOrgIAMPolicy(policy *OrgIAMPolicy) error

+ func (u *Human) HashPasswordIfExisting(policy *PasswordComplexityPolicy, passwordAlg crypto.HashAlgorithm, ...) error

+ func (u *Human) IsInitialState(passwordless, externalIDPs bool) bool

+ func (u *Human) IsValid() bool

+ func (u *Human) SetNamesAsDisplayname()

+ type IAM struct

+ DefaultLabelPolicy *LabelPolicy

+ DefaultLoginPolicy *LoginPolicy

+ DefaultOrgIAMPolicy *OrgIAMPolicy

+ DefaultPasswordAgePolicy *PasswordAgePolicy

+ DefaultPasswordComplexityPolicy *PasswordComplexityPolicy

+ DefaultPasswordLockoutPolicy *LockoutPolicy

+ GlobalOrgID string

+ IAMProjectID string

+ IDPs []*IDPConfig

+ Members []*Member

+ SetUpDone Step

+ SetUpStarted Step

+ type IDPConfig struct

+ AutoRegister bool

+ IDPConfigID string

+ JWTConfig *JWTIDPConfig

+ Name string

+ OIDCConfig *OIDCIDPConfig

+ State IDPConfigState

+ StylingType IDPConfigStylingType

+ Type IDPConfigType

+ type IDPConfigState int32

+ const IDPConfigStateActive

+ const IDPConfigStateInactive

+ const IDPConfigStateRemoved

+ const IDPConfigStateUnspecified

+ func (s IDPConfigState) Exists() bool

+ func (s IDPConfigState) Valid() bool

+ type IDPConfigStylingType int32

+ const IDPConfigStylingTypeGoogle

+ const IDPConfigStylingTypeUnspecified

+ func (f IDPConfigStylingType) Valid() bool

+ func (st IDPConfigStylingType) GetCSSClass() string

+ type IDPConfigType int32

+ const IDPConfigTypeJWT

+ const IDPConfigTypeOIDC

+ const IDPConfigTypeSAML

+ const IDPConfigTypeUnspecified

+ func (f IDPConfigType) Valid() bool

+ type IDPConfigView struct

+ AggregateID string

+ AutoRegister bool

+ ChangeDate time.Time

+ CreationDate time.Time

+ IDPConfigID string

+ IDPProviderType IdentityProviderType

+ IsOIDC bool

+ JWTEndpoint string

+ JWTIssuer string

+ JWTKeysEndpoint string

+ Name string

+ OAuthAuthorizationEndpoint string

+ OAuthTokenEndpoint string

+ OIDCClientID string

+ OIDCClientSecret *crypto.CryptoValue

+ OIDCIDPDisplayNameMapping OIDCMappingField

+ OIDCIssuer string

+ OIDCScopes []string

+ OIDCUsernameMapping OIDCMappingField

+ Sequence uint64

+ State IDPConfigState

+ StylingType IDPConfigStylingType

+ type IDPProvider struct

+ IDPConfigID string

+ IDPConfigType IDPConfigType

+ IDPState IDPConfigState

+ Name string

+ StylingType IDPConfigStylingType

+ Type IdentityProviderType

+ func (p IDPProvider) IsValid() bool

+ type IdentityProviderState int32

+ const IdentityProviderStateActive

+ const IdentityProviderStateRemoved

+ const IdentityProviderStateUnspecified

+ func (s IdentityProviderState) Valid() bool

+ type IdentityProviderType int8

+ const IdentityProviderTypeOrg

+ const IdentityProviderTypeSystem

+ func (f IdentityProviderType) Valid() bool

+ type InitMFADoneScreenText struct

+ CancelButtonText string

+ Description string

+ NextButtonText string

+ Title string

+ type InitMFAOTPScreenText struct

+ CancelButtonText string

+ CodeLabel string

+ Description string

+ NextButtonText string

+ OTPDescription string

+ SecretLabel string

+ Title string

+ type InitMFAPromptScreenText struct

+ Description string

+ NextButtonText string

+ Provider0 string

+ Provider1 string

+ SkipButtonText string

+ Title string

+ type InitMFAU2FScreenText struct

+ Description string

+ ErrorRetry string

+ NotSupported string

+ RegisterTokenButtonText string

+ Title string

+ TokenNameLabel string

+ type InitPasswordDoneScreenText struct

+ CancelButtonText string

+ Description string

+ NextButtonText string

+ Title string

+ type InitPasswordScreenText struct

+ CodeLabel string

+ Description string

+ NewPasswordConfirmLabel string

+ NewPasswordLabel string

+ NextButtonText string

+ ResendButtonText string

+ Title string

+ type InitPasswordStep struct

+ func (s *InitPasswordStep) Type() NextStepType

+ type InitUserCode struct

+ Code *crypto.CryptoValue

+ Expiry time.Duration

+ func NewInitUserCode(generator crypto.Generator) (*InitUserCode, error)

+ type InitUserStep struct

+ PasswordSet bool

+ func (s *InitUserStep) Type() NextStepType

+ type InitializeUserDoneScreenText struct

+ CancelButtonText string

+ Description string

+ NextButtonText string

+ Title string

+ type InitializeUserScreenText struct

+ CodeLabel string

+ Description string

+ NewPasswordConfirmLabel string

+ NewPasswordLabel string

+ NextButtonText string

+ ResendButtonText string

+ Title string

+ type JWTIDPConfig struct

+ HeaderName string

+ IDPConfigID string

+ Issuer string

+ JWTEndpoint string

+ KeysEndpoint string

+ type Key struct

+ Expiry time.Time

+ Key *crypto.CryptoValue

+ func (k *Key) IsValid() bool

+ type KeyPair struct

+ Algorithm string

+ PrivateKey *Key

+ PublicKey *Key

+ Usage KeyUsage

+ func (k *KeyPair) IsValid() bool

+ type KeyUsage int32

+ const KeyUsageSigning

+ func (u KeyUsage) String() string

+ type LabelPolicy struct

+ BackgroundColor string

+ BackgroundColorDark string

+ Default bool

+ DisableWatermark bool

+ ErrorMsgPopup bool

+ Font string

+ FontColor string

+ FontColorDark string

+ HideLoginNameSuffix bool

+ IconDarkURL string

+ IconURL string

+ LogoDarkURL string

+ LogoURL string

+ PrimaryColor string

+ PrimaryColorDark string

+ State LabelPolicyState

+ WarnColor string

+ WarnColorDark string

+ func (f LabelPolicy) IsValid() error

+ type LabelPolicyState int32

+ const LabelPolicyStateActive

+ const LabelPolicyStatePreview

+ const LabelPolicyStateRemoved

+ const LabelPolicyStateUnspecified

+ func (f LabelPolicyState) Valid() bool

+ func (s LabelPolicyState) Exists() bool

+ type LevelOfAssurance int

+ const LevelOfAssuranceNone

+ type LinkUsersStep struct

+ func (s *LinkUsersStep) Type() NextStepType

+ type LinkingUserDoneScreenText struct

+ CancelButtonText string

+ Description string

+ NextButtonText string

+ Title string

+ type LockoutPolicy struct

+ Default bool

+ MaxPasswordAttempts uint64

+ ShowLockOutFailures bool

+ type LoginPolicy struct

+ AllowExternalIDP bool

+ AllowRegister bool

+ AllowUsernamePassword bool

+ Default bool

+ ForceMFA bool

+ HidePasswordReset bool

+ IDPProviders []*IDPProvider

+ IgnoreUnknownUsernames bool

+ MultiFactors []MultiFactorType

+ PasswordlessType PasswordlessType

+ SecondFactors []SecondFactorType

+ func (p *LoginPolicy) HasMultiFactors() bool

+ func (p *LoginPolicy) HasSecondFactors() bool

+ type LoginScreenText struct

+ Description string

+ DescriptionLinking string

+ ExternalUserDescription string

+ LoginNameLabel string

+ LoginnamePlaceholder string

+ MustBeMemberOfOrg string

+ NextButtonText string

+ RegisterButtonText string

+ Title string

+ TitleLinking string

+ UsernamePlaceholder string

+ type LoginStep struct

+ func (s *LoginStep) Type() NextStepType

+ type LoginSucceededStep struct

+ func (s *LoginSucceededStep) Type() NextStepType

+ type LogoutDoneScreenText struct

+ Description string

+ LoginButtonText string

+ Title string

+ type MFALevel int

+ const MFALevelMultiFactor

+ const MFALevelMultiFactorCertified

+ const MFALevelNotSetUp

+ const MFALevelSecondFactor

+ type MFAPromptStep struct

+ MFAProviders []MFAType

+ Required bool

+ func (s *MFAPromptStep) Type() NextStepType

+ type MFAProvidersText struct

+ ChooseOther string

+ Provider0 string

+ Provider1 string

+ type MFAState int32

+ const MFAStateNotReady

+ const MFAStateReady

+ const MFAStateRemoved

+ const MFAStateUnspecified

+ func (f MFAState) Valid() bool

+ type MFAType int

+ const MFATypeOTP

+ const MFATypeU2F

+ const MFATypeU2FUserVerification

+ type MFAVerificationStep struct

+ MFAProviders []MFAType

+ func (s *MFAVerificationStep) Type() NextStepType

+ type Machine struct

+ Description string

+ Name string

+ State UserState

+ Username string

+ func (m Machine) GetState() UserState

+ func (m Machine) GetUsername() string

+ func (sa *Machine) IsValid() bool

+ type MachineKey struct

+ ExpirationDate time.Time

+ KeyID string

+ PrivateKey []byte

+ PublicKey []byte

+ Type AuthNKeyType

+ func (key *MachineKey) Detail() ([]byte, error)

+ func (key *MachineKey) GenerateNewMachineKeyPair(keySize int) error

+ func (key *MachineKey) MarshalJSON() ([]byte, error)

+ type MachineKeyState int32

+ const MachineKeyStateActive

+ const MachineKeyStateRemoved

+ const MachineKeyStateUnspecified

+ func (f MachineKeyState) Valid() bool

+ type MailTemplate struct

+ Default bool

+ State PolicyState

+ Template []byte

+ func (m *MailTemplate) IsValid() bool

+ type Member struct

+ Roles []string

+ UserID string

+ func NewMember(aggregateID, userID string, roles ...string) *Member

+ func (i *Member) IsIAMValid() bool

+ func (i *Member) IsValid() bool

+ type MemberState int32

+ const MemberStateActive

+ const MemberStateRemoved

+ const MemberStateUnspecified

+ func (f MemberState) Valid() bool

+ type MemberType int32

+ const MemberTypeIam

+ const MemberTypeOrganisation

+ const MemberTypeProject

+ const MemberTypeProjectGrant

+ const MemberTypeUnspecified

+ type MessageTexts struct

+ DomainClaimed CustomMessageText

+ InitCode CustomMessageText

+ PasswordReset CustomMessageText

+ PasswordlessRegistration CustomMessageText

+ VerifyEmail CustomMessageText

+ VerifyPhone CustomMessageText

+ func (m *MessageTexts) GetMessageTextByType(msgType string) *CustomMessageText

+ type Metadata struct

+ Key string

+ State MetadataState

+ Value []byte

+ func (m *Metadata) IsValid() bool

+ type MetadataSearchKey int32

+ const MetadataSearchKeyAggregateID

+ const MetadataSearchKeyKey

+ const MetadataSearchKeyResourceOwner

+ const MetadataSearchKeyUnspecified

+ const MetadataSearchKeyValue

+ type MetadataSearchQuery struct

+ Key MetadataSearchKey

+ Method SearchMethod

+ Value interface{}

+ type MetadataSearchRequest struct

+ Asc bool

+ Limit uint64

+ Offset uint64

+ Queries []*MetadataSearchQuery

+ SortingColumn MetadataSearchKey

+ func (r *MetadataSearchRequest) AppendAggregateIDQuery(aggregateID string)

+ func (r *MetadataSearchRequest) AppendResourceOwnerQuery(resourceOwner string)

+ func (r *MetadataSearchRequest) EnsureLimit(limit uint64) error

+ type MetadataSearchResponse struct

+ Limit uint64

+ Offset uint64

+ Result []*Metadata

+ Sequence uint64

+ Timestamp time.Time

+ TotalResult uint64

+ type MetadataState int32

+ const MetadataStateActive

+ const MetadataStateRemoved

+ const MetadataStateUnspecified

+ func (s MetadataState) Exists() bool

+ type MultiFactorType int32

+ const MultiFactorTypeU2FWithPIN

+ const MultiFactorTypeUnspecified

+ func MultiFactorTypes() []MultiFactorType

+ func (f MultiFactorType) Valid() bool

+ type MultifactorConfigs struct

+ OTP OTPConfig

+ type NextStep interface

+ Type func() NextStepType

+ type NextStepType int32

+ const NextStepChangePassword

+ const NextStepChangeUsername

+ const NextStepExternalLogin

+ const NextStepExternalNotFoundOption

+ const NextStepGrantRequired

+ const NextStepInitPassword

+ const NextStepInitUser

+ const NextStepLinkUsers

+ const NextStepLogin

+ const NextStepLoginSucceeded

+ const NextStepMFAPrompt

+ const NextStepMFAVerify

+ const NextStepPassword

+ const NextStepPasswordless

+ const NextStepPasswordlessRegistrationPrompt

+ const NextStepProjectRequired

+ const NextStepRedirectToCallback

+ const NextStepRedirectToExternalIDP

+ const NextStepRegistration

+ const NextStepUnspecified

+ const NextStepUserSelection

+ const NextStepVerifyEmail

+ type NotificationType int32

+ const NotificationTypeEmail

+ const NotificationTypeSms

+ func (f NotificationType) Valid() bool

+ type OIDCApp struct

+ AccessTokenRoleAssertion bool

+ AccessTokenType OIDCTokenType

+ AdditionalOrigins []string

+ AppID string

+ AppName string

+ ApplicationType OIDCApplicationType

+ AuthMethodType OIDCAuthMethodType

+ ClientID string

+ ClientSecret *crypto.CryptoValue

+ ClientSecretString string

+ ClockSkew time.Duration

+ Compliance *Compliance

+ DevMode bool

+ GrantTypes []OIDCGrantType

+ IDTokenRoleAssertion bool

+ IDTokenUserinfoAssertion bool

+ OIDCVersion OIDCVersion

+ PostLogoutRedirectUris []string

+ RedirectUris []string

+ ResponseTypes []OIDCResponseType

+ State AppState

+ func (a *OIDCApp) FillCompliance()

+ func (a *OIDCApp) GetApplicationName() string

+ func (a *OIDCApp) GetState() AppState

+ func (a *OIDCApp) IsValid() bool

+ func (a *OIDCApp) OriginsValid() bool

+ type OIDCApplicationType int32

+ const OIDCApplicationTypeNative

+ const OIDCApplicationTypeUserAgent

+ const OIDCApplicationTypeWeb

+ type OIDCAuthMethodType int32

+ const OIDCAuthMethodTypeBasic

+ const OIDCAuthMethodTypeNone

+ const OIDCAuthMethodTypePost

+ const OIDCAuthMethodTypePrivateKeyJWT

+ type OIDCCodeChallenge struct

+ Challenge string

+ Method OIDCCodeChallengeMethod

+ func (c *OIDCCodeChallenge) IsValid() bool

+ type OIDCCodeChallengeMethod int32

+ const CodeChallengeMethodPlain

+ const CodeChallengeMethodS256

+ type OIDCGrantType int32

+ const OIDCGrantTypeAuthorizationCode

+ const OIDCGrantTypeImplicit

+ const OIDCGrantTypeRefreshToken

+ type OIDCIDPConfig struct

+ AuthorizationEndpoint string

+ ClientID string

+ ClientSecret *crypto.CryptoValue

+ ClientSecretString string

+ IDPConfigID string

+ IDPDisplayNameMapping OIDCMappingField

+ Issuer string

+ Scopes []string

+ TokenEndpoint string

+ UsernameMapping OIDCMappingField

+ type OIDCMappingField int32

+ const OIDCMappingFieldEmail

+ const OIDCMappingFieldPreferredLoginName

+ const OIDCMappingFieldUnspecified

+ func (f OIDCMappingField) Valid() bool

+ type OIDCResponseType int32

+ const OIDCResponseTypeCode

+ const OIDCResponseTypeIDToken

+ const OIDCResponseTypeIDTokenToken

+ type OIDCTokenType int32

+ const OIDCTokenTypeBearer

+ const OIDCTokenTypeJWT

+ type OIDCVersion int32

+ const OIDCVersionV1

+ type OTP struct

+ Secret *crypto.CryptoValue

+ SecretString string

+ State MFAState

+ Url string

+ type OTPConfig struct

+ CryptoMFA crypto.EncryptionAlgorithm

+ Issuer string

+ type ObjectDetails struct

+ EventDate time.Time

+ ResourceOwner string

+ Sequence uint64

+ type Org struct

+ Domains []*OrgDomain

+ IDPs []*IDPConfig

+ LabelPolicy *LabelPolicy

+ LoginPolicy *LoginPolicy

+ Members []*Member

+ Name string

+ OrgIamPolicy *OrgIAMPolicy

+ PasswordAgePolicy *PasswordAgePolicy

+ PasswordComplexityPolicy *PasswordComplexityPolicy

+ PasswordLockoutPolicy *LockoutPolicy

+ PrimaryDomain string

+ State OrgState

+ func (o *Org) AddIAMDomain(iamDomain string)

+ func (o *Org) IsValid() bool

+ type OrgDomain struct

+ Domain string

+ Primary bool

+ ValidationCode *crypto.CryptoValue

+ ValidationType OrgDomainValidationType

+ Verified bool

+ func (domain *OrgDomain) GenerateVerificationCode(codeGenerator crypto.Generator) (string, error)

+ func (domain *OrgDomain) IsValid() bool

+ type OrgDomainState int32

+ const OrgDomainStateActive

+ const OrgDomainStateRemoved

+ const OrgDomainStateUnspecified

+ func (f OrgDomainState) Valid() bool

+ type OrgDomainValidationType int32

+ const OrgDomainValidationTypeDNS

+ const OrgDomainValidationTypeHTTP

+ const OrgDomainValidationTypeUnspecified

+ func (t OrgDomainValidationType) CheckType() (http_util.CheckType, bool)

+ type OrgIAMPolicy struct

+ Default bool

+ UserLoginMustBeDomain bool

+ type OrgState int32

+ const OrgStateActive

+ const OrgStateInactive

+ const OrgStateRemoved

+ const OrgStateUnspecified

+ type Password struct

+ ChangeRequired bool

+ SecretCrypto *crypto.CryptoValue

+ SecretString string

+ func NewPassword(password string) *Password

+ func (p *Password) HashPasswordIfExisting(policy *PasswordComplexityPolicy, passwordAlg crypto.HashAlgorithm) error

+ type PasswordAgePolicy struct

+ ExpireWarnDays uint64

+ MaxAgeDays uint64

+ type PasswordChangeDoneScreenText struct

+ Description string

+ NextButtonText string

+ Title string

+ type PasswordChangeScreenText struct

+ CancelButtonText string

+ Description string

+ NewPasswordConfirmLabel string

+ NewPasswordLabel string

+ NextButtonText string

+ OldPasswordLabel string

+ Title string

+ type PasswordCode struct

+ Code *crypto.CryptoValue

+ Expiry time.Duration

+ NotificationType NotificationType

+ func NewPasswordCode(passwordGenerator crypto.Generator) (*PasswordCode, error)

+ type PasswordComplexityPolicy struct

+ Default bool

+ HasLowercase bool

+ HasNumber bool

+ HasSymbol bool

+ HasUppercase bool

+ MinLength uint64

+ func (p *PasswordComplexityPolicy) Check(password string) error

+ func (p *PasswordComplexityPolicy) IsValid() error

+ type PasswordResetDoneScreenText struct

+ Description string

+ NextButtonText string

+ Title string

+ type PasswordScreenText struct

+ BackButtonText string

+ Confirmation string

+ Description string

+ HasLowercase string

+ HasNumber string

+ HasSymbol string

+ HasUppercase string

+ MinLength string

+ NextButtonText string

+ PasswordLabel string

+ ResetLinkText string

+ Title string

+ type PasswordStep struct

+ func (s *PasswordStep) Type() NextStepType

+ type PasswordlessInitCode struct

+ Code string

+ CodeID string

+ Expiration time.Duration

+ State PasswordlessInitCodeState

+ func (p *PasswordlessInitCode) Link(baseURL string) string

+ type PasswordlessInitCodeState int32

+ const PasswordlessInitCodeStateActive

+ const PasswordlessInitCodeStateRemoved

+ const PasswordlessInitCodeStateRequested

+ const PasswordlessInitCodeStateUnspecified

+ type PasswordlessPromptScreenText struct

+ Description string

+ DescriptionInit string

+ NextButtonText string

+ PasswordlessButtonText string

+ SkipButtonText string

+ Title string

+ type PasswordlessRegistrationDoneScreenText struct

+ CancelButtonText string

+ Description string

+ DescriptionClose string

+ NextButtonText string

+ Title string

+ type PasswordlessRegistrationPromptStep struct

+ func (s *PasswordlessRegistrationPromptStep) Type() NextStepType

+ type PasswordlessRegistrationScreenText struct

+ Description string

+ ErrorRetry string

+ NotSupported string

+ RegisterTokenButtonText string

+ Title string

+ TokenNameLabel string

+ type PasswordlessScreenText struct

+ Description string

+ ErrorRetry string

+ LoginWithPwButtonText string

+ NotSupported string

+ Title string

+ ValidateTokenButtonText string

+ type PasswordlessStep struct

+ PasswordSet bool

+ func (s *PasswordlessStep) Type() NextStepType

+ type PasswordlessType int32

+ const PasswordlessTypeAllowed

+ const PasswordlessTypeNotAllowed

+ func (f PasswordlessType) Valid() bool

+ type Permissions struct

+ Permissions []string

+ func (p *Permissions) AppendPermissions(ctxID string, permissions ...string)

+ type PersonalAccessTokenState int32

+ const PersonalAccessTokenStateActive

+ const PersonalAccessTokenStateRemoved

+ const PersonalAccessTokenStateUnspecified

+ func (f PersonalAccessTokenState) Valid() bool

+ type Phone struct

+ IsPhoneVerified bool

+ PhoneNumber string

+ func (p *Phone) IsValid() bool

+ type PhoneCode struct

+ Code *crypto.CryptoValue

+ Expiry time.Duration

+ func NewPhoneCode(phoneGenerator crypto.Generator) (*PhoneCode, error)

+ type PhoneState int32

+ const PhoneStateActive

+ const PhoneStateRemoved

+ const PhoneStateUnspecified

+ func (s PhoneState) Exists() bool

+ func (s PhoneState) Valid() bool

+ type PolicyState int32

+ const PolicyStateActive

+ const PolicyStateRemoved

+ const PolicyStateUnspecified

+ func (f PolicyState) Valid() bool

+ func (s PolicyState) Exists() bool

+ type PrivacyPolicy struct

+ Default bool

+ HelpLink string

+ PrivacyLink string

+ State PolicyState

+ TOSLink string

+ type PrivateLabelingSetting int32

+ const PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy

+ const PrivateLabelingSettingEnforceProjectResourceOwnerPolicy

+ const PrivateLabelingSettingUnspecified

+ type Profile struct

+ DisplayName string

+ FirstName string

+ Gender Gender

+ LastName string

+ LoginNames []string

+ NickName string

+ PreferredLanguage language.Tag

+ PreferredLoginName string

+ func (p *Profile) IsValid() bool

+ type Project struct

+ HasProjectCheck bool

+ Name string

+ PrivateLabelingSetting PrivateLabelingSetting

+ ProjectRoleAssertion bool

+ ProjectRoleCheck bool

+ State ProjectState

+ func (o *Project) IsValid() bool

+ type ProjectGrant struct

+ GrantID string

+ GrantedOrgID string

+ RoleKeys []string

+ State ProjectGrantState

+ func (g *ProjectGrant) HasInvalidRoles(validRoles []string) bool

+ func (p *ProjectGrant) IsValid() bool

+ type ProjectGrantIDs struct

+ GrantID string

+ ProjectID string

+ type ProjectGrantMember struct

+ GrantID string

+ Roles []string

+ UserID string

+ func NewProjectGrantMember(aggregateID, userID, grantID string, roles ...string) *ProjectGrantMember

+ func (i *ProjectGrantMember) IsValid() bool

+ type ProjectGrantState int32

+ const ProjectGrantStateActive

+ const ProjectGrantStateInactive

+ const ProjectGrantStateRemoved

+ const ProjectGrantStateUnspecified

+ type ProjectRequiredStep struct

+ func (s *ProjectRequiredStep) Type() NextStepType

+ type ProjectRole struct

+ DisplayName string

+ Group string

+ Key string

+ func NewProjectRole(projectID, key string) *ProjectRole

+ func (p *ProjectRole) IsValid() bool

+ type ProjectRoleState int32

+ const ProjectRoleStateActive

+ const ProjectRoleStateRemoved

+ const ProjectRoleStateUnspecified

+ type ProjectState int32

+ const ProjectStateActive

+ const ProjectStateInactive

+ const ProjectStateRemoved

+ const ProjectStateUnspecified

+ type Prompt int32

+ const PromptConsent

+ const PromptCreate

+ const PromptLogin

+ const PromptNone

+ const PromptSelectAccount

+ const PromptUnspecified

+ type RedirectToCallbackStep struct

+ func (s *RedirectToCallbackStep) Type() NextStepType

+ type RedirectToExternalIDPStep struct

+ func (s *RedirectToExternalIDPStep) Type() NextStepType

+ type RegistrationOptionScreenText struct

+ Description string

+ ExternalLoginDescription string

+ RegisterUsernamePasswordButtonText string

+ Title string

+ type RegistrationOrgScreenText struct

+ Description string

+ EmailLabel string

+ FirstnameLabel string

+ LastnameLabel string

+ OrgNameLabel string

+ PasswordConfirmLabel string

+ PasswordLabel string

+ PrivacyLinkText string

+ SaveButtonText string

+ TOSAndPrivacyLabel string

+ TOSConfirm string

+ TOSConfirmAnd string

+ TOSLinkText string

+ Title string

+ UsernameLabel string

+ type RegistrationStep struct

+ func (s *RegistrationStep) Type() NextStepType

+ type RegistrationUserScreenText struct

+ BackButtonText string

+ Description string

+ DescriptionOrgRegister string

+ EmailLabel string

+ FirstnameLabel string

+ GenderLabel string

+ LanguageLabel string

+ LastnameLabel string

+ NextButtonText string

+ PasswordConfirmLabel string

+ PasswordLabel string

+ PrivacyLinkText string

+ TOSAndPrivacyLabel string

+ TOSConfirm string

+ TOSConfirmAnd string

+ TOSLinkText string

+ Title string

+ UsernameLabel string

+ type Request interface

+ IsValid func() bool

+ Type func() AuthRequestType

+ type SearchMethod int32

+ const SearchMethodContains

+ const SearchMethodContainsIgnoreCase

+ const SearchMethodEndsWith

+ const SearchMethodEndsWithIgnoreCase

+ const SearchMethodEquals

+ const SearchMethodEqualsIgnoreCase

+ const SearchMethodGreaterThan

+ const SearchMethodIsOneOf

+ const SearchMethodLessThan

+ const SearchMethodListContains

+ const SearchMethodNotEquals

+ const SearchMethodStartsWith

+ const SearchMethodStartsWithIgnoreCase

+ type SecondFactorType int32

+ const SecondFactorTypeOTP

+ const SecondFactorTypeU2F

+ const SecondFactorTypeUnspecified

+ func SecondFactorTypes() []SecondFactorType

+ func (f SecondFactorType) Valid() bool

+ type SelectAccountScreenText struct

+ Description string

+ DescriptionLinking string

+ MustBeMemberOfOrg string

+ OtherUser string

+ SessionState0 string

+ SessionState1 string

+ Title string

+ TitleLinking string

+ type SelectUserStep struct

+ Users []UserSelection

+ func (s *SelectUserStep) Type() NextStepType

+ type Step int

+ const Step1

+ const Step10

+ const Step11

+ const Step12

+ const Step13

+ const Step14

+ const Step15

+ const Step16

+ const Step17

+ const Step18

+ const Step19

+ const Step2

+ const Step20

+ const Step21

+ const Step22

+ const Step3

+ const Step4

+ const Step5

+ const Step6

+ const Step7

+ const Step8

+ const Step9

+ const StepCount

+ type SuccessLoginScreenText struct

+ AutoRedirectDescription string

+ NextButtonText string

+ RedirectedDescription string

+ Title string

+ type Token struct

+ ApplicationID string

+ Audience []string

+ Expiration time.Time

+ PreferredLanguage string

+ RefreshTokenID string

+ Scopes []string

+ TokenID string

+ UserAgentID string

+ type TriggerType int32

+ const TriggerTypePostAuthentication

+ const TriggerTypePostCreation

+ const TriggerTypePreCreation

+ const TriggerTypeUnspecified

+ func (s TriggerType) Valid() bool

+ type UniqueConstraintMigration struct

+ AggregateID string

+ ErrorMessage string

+ ObjectID string

+ UniqueField string

+ UniqueType string

+ type User interface

+ GetState func() UserState

+ GetUsername func() string

+ type UserAuthMethodType int32

+ const UserAuthMethodTypeOTP

+ const UserAuthMethodTypePasswordless

+ const UserAuthMethodTypeU2F

+ const UserAuthMethodTypeUnspecified

+ func (f UserAuthMethodType) Valid() bool

+ type UserGrant struct

+ ProjectGrantID string

+ ProjectID string

+ RoleKeys []string

+ State UserGrantState

+ UserID string

+ func (g *UserGrant) HasInvalidRoles(validRoles []string) bool

+ func (u *UserGrant) IsValid() bool

+ type UserGrantState int32

+ const UserGrantStateActive

+ const UserGrantStateInactive

+ const UserGrantStateRemoved

+ const UserGrantStateUnspecified

+ type UserIDPLink struct

+ DisplayName string

+ ExternalUserID string

+ IDPConfigID string

+ func (idp *UserIDPLink) IsValid() bool

+ type UserIDPLinkState int32

+ const UserIDPLinkStateActive

+ const UserIDPLinkStateRemoved

+ const UserIDPLinkStateUnspecified

+ func (s UserIDPLinkState) Valid() bool

+ type UserMembership struct

+ AggregateID string

+ ChangeDate time.Time

+ CreationDate time.Time

+ DisplayName string

+ MemberType MemberType

+ ObjectID string

+ ResourceOwner string

+ ResourceOwnerName string

+ Roles []string

+ Sequence uint64

+ UserID string

+ type UserSelection struct

+ AvatarKey string

+ DisplayName string

+ LoginName string

+ ResourceOwner string

+ SelectionPossible bool

+ UserID string

+ UserName string

+ UserSessionState UserSessionState

+ type UserSessionState int32

+ const UserSessionStateActive

+ const UserSessionStateTerminated

+ type UserState int32

+ const UserStateActive

+ const UserStateDeleted

+ const UserStateInactive

+ const UserStateInitial

+ const UserStateLocked

+ const UserStateSuspend

+ const UserStateUnspecified

+ func (f UserState) Valid() bool

+ func (s UserState) Exists() bool

+ type UserType int32

+ const UserTypeHuman

+ const UserTypeMachine

+ const UserTypeUnspecified

+ func (f UserType) Valid() bool

+ type UserVerificationRequirement int32

+ const UserVerificationRequirementDiscouraged

+ const UserVerificationRequirementPreferred

+ const UserVerificationRequirementRequired

+ const UserVerificationRequirementUnspecified

+ type UsernameChangeDoneScreenText struct

+ Description string

+ NextButtonText string

+ Title string

+ type UsernameChangeScreenText struct

+ CancelButtonText string

+ Description string

+ NextButtonText string

+ Title string

+ UsernameLabel string

+ type VerifyEMailStep struct

+ func (s *VerifyEMailStep) Type() NextStepType

+ type VerifyMFAOTPScreenText struct

+ CodeLabel string

+ Description string

+ NextButtonText string

+ Title string

+ type VerifyMFAU2FScreenText struct

+ Description string

+ ErrorRetry string

+ NotSupported string

+ Title string

+ ValidateTokenButtonText string

+ type WebAuthNLogin struct

+ AllowedCredentialIDs [][]byte

+ Challenge string

+ CredentialAssertionData []byte

+ UserVerification UserVerificationRequirement

+ type WebAuthNToken struct

+ AAGUID []byte

+ AllowedCredentialIDs [][]byte

+ AttestationType string

+ Challenge string

+ CredentialCreationData []byte

+ KeyID []byte

+ PublicKey []byte

+ SignCount uint32

+ State MFAState

+ UserVerification UserVerificationRequirement

+ WebAuthNTokenID string

+ WebAuthNTokenName string

+ func GetTokenByKeyID(tokens []*WebAuthNToken, keyID []byte) (int, *WebAuthNToken)

+ func GetTokenToVerify(tokens []*WebAuthNToken) (int, *WebAuthNToken)

v1.80.0-v2.20

May 4, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.19

May 3, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.18

May 2, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.17

May 2, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.16

May 2, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.15

May 2, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.14

May 2, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.13

Apr 29, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.12

Apr 29, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.11

Apr 28, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.10

Apr 28, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.9

Apr 27, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.8

Apr 27, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-v2.7

Apr 27, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.8

May 16, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.7

May 13, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.6

May 13, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.5

May 13, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.4

May 11, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.3

May 10, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.2

May 9, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-pref-login-name.1

May 6, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel

v1.80.0-lower-headers.1

Apr 27, 2022 GO-2024-2637 +13 more

GO-2024-2637: Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel

GO-2024-2655: XSS in github.com/zitadel/zitadel

GO-2024-2664: ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel

GO-2024-2665: ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

GO-2024-2788: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

GO-2024-2804: Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel

GO-2024-2968: ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

GO-2024-3014: ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

GO-2024-3015: ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

GO-2024-3137: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3138: ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel

GO-2024-3139: ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel

GO-2024-3216: Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel

GO-2024-3217: User Registration Bypass in Zitadel in github.com/zitadel/zitadel