CVE-2024-29892

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
zitadelzitadel< 2.42.17; >= 2.43.0, < 2.43.11; >= 2.44.0, < 2.44.7; >= 2.45.0, < 2.45.5; >= 2.46.0, < 2.46.5; >= 2.47.0, < 2.47.8; >= 2.48.0, < 2.48.3
zitadelzitadel< 2.42.17; >= 2.43.0, < 2.43.11; >= 2.44.0, < 2.44.7; >= 2.45.0, < 2.45.5; >= 2.46.0, < 2.46.5; >= 2.47.0, < 2.47.8; >= 2.48.0, < 2.48.3

References

Timeline

Published
Mar 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-298936.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgCVE-2024-298944.7Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scrCVE-2024-2989510.0Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows anCVE-2024-298967.5Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers geCVE-2024-298974.9CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) oCVE-2024-298986.5CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-2989CVE-2024-29908.8A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. This affects the function formexeCommand of the file /CVE-2024-299007.5Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready CVE-2024-299018.1The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can rCVE-2024-299025.9Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachmenCVE-2024-299037.5Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts caCVE-2024-299047.5CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability c
CVE-2024-29892: Medium severity, CVSS 4.9 | Vulnix