CVE-2024-39683

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.

• CWE-200

• https://discord.com/channels/927474939156643850/1254096852937347153Permissions Required, URL Repurposed
• https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04Patch
• https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3daPatch
• https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73Patch
• https://github.com/zitadel/zitadel/issues/8213Issue Tracking, Release Notes
• https://github.com/zitadel/zitadel/pull/8231Issue Tracking
• https://github.com/zitadel/zitadel/releases/tag/v2.53.8Release Notes
• https://github.com/zitadel/zitadel/releases/tag/v2.54.5Release Notes
• https://github.com/zitadel/zitadel/releases/tag/v2.55.1Release Notes
• https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397Vendor Advisory
• https://discord.com/channels/927474939156643850/1254096852937347153Permissions Required, URL Repurposed
• https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04Patch
• https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3daPatch
• https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73Patch
• https://github.com/zitadel/zitadel/issues/8213Issue Tracking, Release Notes
• https://github.com/zitadel/zitadel/pull/8231Issue Tracking
• https://github.com/zitadel/zitadel/releases/tag/v2.53.8Release Notes
• https://github.com/zitadel/zitadel/releases/tag/v2.54.5Release Notes
• https://github.com/zitadel/zitadel/releases/tag/v2.55.1Release Notes
• https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397Vendor Advisory

Published

Jul 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39678Cooked is a recipe plugin for WordPress. The Cooked plugin i…8.8
• CVE-2024-39679Cooked is a recipe plugin for WordPress. The Cooked plugin f…8.8
• CVE-2024-3968Remote Code Execution has been discovered in OpenText™ iMana…9.8
• CVE-2024-39680Cooked is a recipe plugin for WordPress. The Cooked plugin f…8.8
• CVE-2024-39681Cooked is a recipe plugin for WordPress. The Cooked plugin f…8.8
• CVE-2024-39682Cooked is a recipe plugin for WordPress. The Cooked plugin f…5.4
• CVE-2024-39684Tencent RapidJSON is vulnerable to privilege escalation due …7.8
• CVE-2024-39685Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39686Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39687Fedify is a TypeScript library for building federated server…7.2
• CVE-2024-39688Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…6.5
• CVE-2024-39689Certifi is a curated collection of Root Certificates for val…7.5