CVE-2026-29191: 
NixOS vulnerability analysis and mitigation

CVE-2026-29191 is a critical Cross-Site Scripting (XSS) vulnerability in Zitadel's login V2 interface, specifically in the /saml-post HTTP endpoint, enabling 1-click account takeover. It affects Zitadel versions 4.0.0 through 4.11.1 (Go module github.com/zitadel/zitadel and github.com/zitadel/zitadel/v2). The vulnerability was discovered by Amit Laish from GE Vernova, published on March 4, 2026, and patched in version 4.12.0. It carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Zitadel Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The /saml-post endpoint accepts two HTTP GET parameters (url and id) and auto-submits a POST request to the provided url value in users' browsers. Two distinct attack vectors exist: (1) the url parameter allows a javascript: scheme, causing immediate JavaScript execution in the victim's browser; and (2) user-supplied input from both parameters is reflected in the server response without HTML encoding, enabling arbitrary HTML/JS injection. Critically, the vulnerability is exploitable in Zitadel's default out-of-the-box configuration — a SAML IdP integration is not required (GitHub Advisory, Zitadel Advisory).

An unauthenticated remote attacker who tricks a victim into clicking a crafted link can execute arbitrary JavaScript in the victim's browser within the Zitadel origin context. The primary attack chain leverages the XSS to trigger a password reset flow on behalf of the victim, enabling full account takeover with high confidentiality and integrity impact. Accounts protected by Multi-Factor Authentication (MFA) or Passwordless authentication are partially mitigated against the account takeover vector, but remain exposed to credential theft and session hijacking (GitHub Advisory, SecurityOnline).

No public proof-of-concept exploit code has been observed as of the time of reporting, and there is no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.018% (5th percentile), indicating a currently low predicted exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity, no authentication requirement, and the ability to achieve full account takeover with a single user interaction make it an attractive target (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Zitadel instances running versions 4.0.0–4.11.1 using tools like Shodan or Censys, or by checking the Zitadel version endpoint.
2. Craft malicious URL: Construct a URL targeting the /saml-post endpoint with a malicious url parameter using a javascript: scheme (e.g., /saml-post?url=javascript:alert(document.cookie)&id=test) or inject arbitrary HTML via unencoded input in the id parameter.
3. Deliver the payload: Send the crafted link to a target Zitadel user via phishing email, social engineering, or any other delivery mechanism that causes the victim to click the link.
4. JavaScript execution: When the victim's browser loads the endpoint, it auto-submits a POST to the attacker-controlled url or executes the injected JavaScript within the Zitadel origin.
5. Account takeover: The malicious JavaScript triggers a password reset request on behalf of the victim (exploiting the authenticated session context), allowing the attacker to set a new password and take over the account. MFA-protected accounts resist this final step (GitHub Advisory, Zitadel Advisory).

• Network: HTTP GET requests to /saml-post containing javascript: in the url parameter; requests to /saml-post with unusual or encoded HTML/script content in url or id parameters; unexpected outbound connections from the Zitadel server following user interaction with the endpoint.
• Logs: Web server or application access logs showing requests to /saml-post with suspicious parameter values (e.g., url=javascript:, url=http://attacker.com, or HTML tags in id); password reset events for users who did not initiate a reset, particularly shortly after accessing /saml-post.
• Application: Unexpected password change events in Zitadel audit logs for accounts that did not request a reset; new sessions created from unfamiliar IP addresses following a password reset event.

The primary remediation is to upgrade Zitadel to version 4.12.0 or later, which removes the /saml-post endpoint entirely and additionally requires the user's current password for all password change operations regardless of session state (GitHub Advisory). If an immediate upgrade is not feasible and no SAML IdP integration is required, deploy a WAF or reverse proxy rule to block all access to the /saml-post endpoint. Additionally, enforcing MFA or Passwordless authentication for all users significantly mitigates the account takeover risk even on unpatched instances (Zitadel Advisory).

The vulnerability received notable coverage across security media, with outlets such as SecurityOnline, GBHackers, and CyberPress highlighting the "1-click account takeover" nature of the flaw (SecurityOnline, GBHackers). The Hacker Wire and Infosec Exchange also amplified the advisory shortly after publication. A detailed technical write-up was published by Infinit Security, describing the exploitation chain (Infinit Security). Community sentiment emphasized the severity of the default-configuration exposure and the importance of MFA as a partial mitigation.