Answer in brief
CVE-2024-39683 records a Medium severity (CVSS 5.7) vulnerability in ZITADEL Vulnerable to Session Information Leakage. The current sources do not mark it as known exploited. The current feed maps github.com/zitadel/zitadel (go), github.com/zitadel/zitadel (go), github.com/zitadel/zitadel (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/zitadel/zitadel (go), github.com/zitadel/zitadel (go), github.com/zitadel/zitadel (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/zitadel/zitadelgo | >=2.0.0 <2.53.8 | 2.53.8 |
| github.com/zitadel/zitadelgo | >=2.54.0 <2.54.5 | 2.54.5 |
| github.com/zitadel/zitadelgo | >=2.55.0 <2.55.1 | 2.55.1 |
Published upstream
Jul 5, 2024
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
### Impact ZITADEL provides users the ability to list all user sessions of the current user agent (browser) by API and in the Console UI. Due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Note that the Login UI was never affected and there was no possibility to take over such a session. ### Patches 2.x versions are fixed on >= [2.55.1](https://github.com/zitadel/zitadel/releases/tag/v2.55.1) 2.54.x versions are fixed on >= [2.54.5](https://github.com/zitadel/zitadel/releases/tag/v2.54.5) 2.53.x versions are fixed on >= [2.53.8](https://github.com/zitadel/zitadel/releases/tag/v2.53.8) ZITADEL recommends upgrading to the latest versions available in due course. ### Workarounds There is no workaround since a patch is already available. ### References - https://github.com/zitadel/zitadel/pull/8231 - https://discord.com/channels/927474939156643850/1254096852937347153 - https://github.com/zitadel/zitadel/issues/8213 ### Questions If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected]) ### Credits Thanks to @cybertransformer, @Avolicious, @AmirhoseinBrz and @srividyaj for finding and reporting the vulnerability.
Quoted source text, attributed separately from HOL analysis.