1-Click ZITADEL Vulnerability Could Allow Full System Takeover

A critical XSS vulnerability (CVE-2026-29191) in ZITADEL's /saml-post endpoint allows unauthenticated attackers to execute JavaScript in users' browsers via crafted links, enabling silent password resets and full account takeover; the issue affects default installations of versions 4.0.0–4.11.1 and is fixed in 4.12.0. Immediate remediation steps are to upgrade to 4.12.0 or higher, enforce MFA or passwordless authentication, and, if immediate upgrading is infeasible, block access to the vulnerable endpoint with a WAF or reverse-proxy rules.