{"id":"CVE-2026-55671","aliases":["GHSA-29jh-8cfq-rr8x","GO-2026-5059"],"url":"https://o3.security/vulnerability/CVE-2026-55671","summary":"ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components","details":"ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to loopback, internal IP, link-local, or redirected endpoints through DNS rebinding, redirects, or protocol downgrades. This issue is fixed in version 4.15.2.","published":"2026-07-10T17:17:50.095Z","modified":"2026-08-12T03:51:29.449267031Z","cvss":null,"epss":{"score":0.00414,"percentile":0.34886,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2"}],"fix":{"url":"https://github.com/zitadel/zitadel/commit/b6f78086913b8d916bce9ab2e049ab0d84f947fd","label":"zitadel/zitadel@b6f7808"},"references":[{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v4.15.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55671.json"},{"type":"ADVISORY","url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-29jh-8cfq-rr8x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55671"},{"type":"FIX","url":"https://github.com/zitadel/zitadel/commit/b6f78086913b8d916bce9ab2e049ab0d84f947fd"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.449267031Z"}}