Issues

• [Bug]: Login V2 email login fails at the password step when the auth request has no org scope (loginname and password steps use different context settings)

  zitadel/zitadel#13019 · Filter by author cas7breeder opened on Oct 30, 2026

• Management Console: manage HTTP email and SMS providers

  zitadel/zitadel#13017 · Filter by author Ahmadshoh opened on Oct 30, 2026

• Redis cache circuit breaker never closes after one trip

  zitadel/zitadel#13016 · Filter by author othoathydrahost opened on Oct 29, 2026
  1

• Login V2 API: let the login add urn:zitadel:iam:org:roles:id: to a pending auth request

  Enhancement

  zitadel/zitadel#13015 · Filter by author paveq opened on Oct 29, 2026

• [Bug]: Login UI v2 (zitadel-login) returns HTTP 500 "TypeError: i.map is not a function" when a non-array "sessions" cookie exists on the host

  Bug

  zitadel/zitadel#13011 · Filter by author Think-Jay opened on Oct 29, 2026

• Hosted Login V1: avoid displaying internal error IDs in native tooltips

  zitadel/zitadel#13008 · Filter by author contactarchorys-spec opened on Oct 28, 2026

• Console: clarify pending redirect URI input before saving

  zitadel/zitadel#13007 · Filter by author ChrisAdels opened on Oct 27, 2026

• [Bug]: ZITADEL Cloud returns 404 Instance not found

  Bug

  zitadel/zitadel#13005 · Filter by author 9vh6pzh8v7-hue opened on Oct 27, 2026
  1

• [Bug]: Login V2: a refused session token in the sessions cookie blocks sign-in (PermissionDenied QUERY-dsfr3 crashes /password; account selection does nothing)

  zitadel/zitadel#13004 · Filter by author kulmin opened on Oct 27, 2026

• [Bug]: Console incorrectly warns about HTTPS redirect URIs for Native applications

  Bug

  zitadel/zitadel#13002 · Filter by author matiasracedo opened on Oct 27, 2026

• Use Go package github.com/zitadel/zitadel in security advisories

  zitadel/zitadel#12989 · Filter by author OsamaSE opened on Oct 23, 2026

• Expose the passkey assertion's authenticatorAttachment on the session WebAuthN factor

  zitadel/zitadel#12988 · Filter by author pannpers opened on Oct 23, 2026

• Login V2: use the WebAuthn Signal API to keep passkey managers in sync after a passkey is removed

  zitadel/zitadel#12987 · Filter by author pannpers opened on Oct 23, 2026

• Login V2 /passkey/set shows no message when the browser refuses an existing credential (InvalidStateError)

  zitadel/zitadel#12986 · Filter by author pannpers opened on Oct 23, 2026

• [Bug]: Login V2 — after a correct password the push to the second-factor screen is sometimes discarded, leaving the password screen with Continue re-enabled

  zitadel/zitadel#12985 · Filter by author Rudi-Bezuidenhout opened on Oct 22, 2026

• Lack of Rate Limiting on SMS Resend Button Leads to Excessive SMS Charges

  ng-v4-legacy

  HighFilter by Priority: High
  Bug

  zitadel/zitadel#12984 · Filter by author fcoppede opened on Oct 22, 2026
  

• Deleting an organization identity provider leaves user IdP links; Login V2 then fails with an internal error

  zitadel/zitadel#12980 · Filter by author ixcans opened on Oct 22, 2026

• [Bug]: CreateCallback links the session, then answers 500 for a dev-mode redirect URI that is not a valid URL

  zitadel/zitadel#12979 · Filter by author AmmarAR97 opened on Oct 22, 2026

• [Bug]: SetPassword with currentPassword equal to the new password answers 500 COMMAND-CahN2 and records a failed password check

  zitadel/zitadel#12978 · Filter by author AmmarAR97 opened on Oct 22, 2026
  1

• [Bug]: A target that answers with a 5xx status gives an error with status 400

  zitadel/zitadel#12976 · Filter by author vlkornev opened on Oct 21, 2026

• [Bug]: A failed refresh_token request consumes the refresh token, ending the grant

  zitadel/zitadel#12974 · Filter by author vlkornev opened on Oct 21, 2026

• Login V2: Provide specific errors for session resolution failures

  ng-v4-legacy

  HighFilter by Priority: High
  Enhancement

  zitadel/zitadel#12968 · Filter by author matiasracedo opened on Oct 20, 2026
  

• [Bug]: Login V2 account switcher drops organization for external-IdP accounts — switching to a non-default-org account re-resolves to the default org

  Bug

  zitadel/zitadel#12963 · Filter by author ready4droid opened on Oct 20, 2026

• [Bug]: Login V2: "Could not verify passkey" (500 Error) due to 4 KB sessions cookie overflow dropping WebAuthn challenge state

  Bug

  zitadel/zitadel#12959 · Filter by author fcoppede opened on Oct 20, 2026

• [Bug]: Console never shows "Send Password Reset Link" on the user page

  Bug

  zitadel/zitadel#12958 · Filter by author jrklasen opened on Oct 20, 2026
  1