Zitadel

Why This Matters Now The recent release of CVE-2026-32130 has brought significant attention to vulnerabilities in ZITADEL’s SCIM (System for Cross-domain Identity Management) implementation. This particular vulnerability allows attackers to bypass authentication by exploiting URL encoding in SCIM requests. Given the critical nature of SCIM in managing user identities across different systems, this issue poses a substantial risk to organizations relying on ZITADEL for identity management. 🚨 Breaking: CVE-2026-32130 exposes SCIM endpoints to unauthorized access. Apply the latest Endor patches immediately to mitigate this risk. 50+Organizations Affected 24hrsTime to Patch Understanding the Vulnerability CVE-2026-32130 involves a flaw in how ZITADEL processes URL-encoded data in SCIM requests. Attackers can exploit this by sending specially crafted requests that manipulate URL parameters to bypass authentication checks. This can lead to unauthorized access to SCIM endpoints, enabling attackers to create, read, update, or delete user identities without proper authorization. ...

Keycloak is the established open-source IAM platform with 41,000+ GitHub stars and CNCF backing. Zitadel is the challenger — a Go-based, event-sourced platform growing rapidly at 13,000+ stars. This comparison covers architecture, features, operations, and when each is the better choice. At a Glance Keycloak Zitadel Language Java (Quarkus) Go License Apache 2.0 AGPL-3.0 (v3+) GitHub Stars 41,000+ 13,000+ CNCF Status Incubating Not a CNCF project First Release 2014 2019 Maintainer Red Hat CAOS AG (Switzerland) Architecture Stateful (Infinispan cache) Stateless (event-sourced) Database PostgreSQL, MySQL, MariaDB, Oracle, MSSQL PostgreSQL only Cloud Offering Red Hat Build of Keycloak (subscription) Zitadel Cloud (free tier: 100 DAU) Architecture Keycloak Keycloak runs on Java/Quarkus with Infinispan for distributed session caching. A production deployment requires Keycloak nodes + an external database + Infinispan cluster configuration. Nodes are stateful — they hold session data in memory, requiring sticky sessions for optimal performance. ...