zitadel
ZITADEL's ten flaws: how a self-hosted identity provider let anyone sign in as anyone
NVD cataloged ten authentication and authorization flaws in ZITADEL, the open-source identity provider, on 2026-10-04. The shared shape is a login flow that treated "knowing a username" as if it were "proving a password." The fixes shipped in three waves over the prior two months.