{
 "slug": "zitadel",
 "name": "Zitadel",
 "tagline": "Identity and access management with OIDC, SAML, SCIM and passkeys",
 "category": "security-identity",
 "use_cases": [
  "sso",
  "identity-provider",
  "passkeys"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Zitadel (CAOS Ltd.)",
  "url": "https://zitadel.com",
  "license": "AGPL-3.0-only",
  "license_url": "https://github.com/zitadel/zitadel/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   22,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.20.0",
   "last_build": "2026-10-23",
   "entity_id": "prod-t7ciekoxedxe6",
   "ami_alias": "/aws/service/marketplace/prod-t7ciekoxedxe6/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-7hxsc6xh2gzho",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.19.4",
   "last_build": "2026-10-02",
   "offer_id": "zitadel",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:zitadel:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.zitadel?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/zitadel/",
  "json": "https://lynxroute.com/products/zitadel/product.json"
 },
 "release_notes": [
  {
   "version": "4.20.0",
   "title": "Zitadel 4.20.0",
   "notes": "* Zitadel updated 4.19.4 -> 4.20.0. AGPL-3.0-only unchanged; corresponding source at https://github.com/zitadel/zitadel/tree/v4.20.0\n* Security: device authorization now requires explicit consent, login proofs are signed, invalid public-host headers are rejected and list queries are bounded\n* Built with Go 1.26.10\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "4.19.4",
   "title": "Zitadel 4.19.4",
   "notes": "* Zitadel updated 4.17.3 -> 4.19.4. AGPL-3.0-only unchanged\n* Security: fixes two high-severity account-takeover issues - SAML assertions from a different identity provider than the sign-in request are now rejected, and the hosted login UI now signs its session cookie\n* Security: end-user impersonators can no longer impersonate administrators; impersonating an administrator now requires the admin impersonation permission\n* Fixes projections that could skip events, forwards login_hint to external identity providers, and speeds up user listing and login-name lookups on large instances\n* Bundled PostgreSQL 17 and the hosted login UI under /ui/v2/login; no credentials baked into the image - all secrets are generated on this instance at first launch\n* Certbot pre-installed for a trusted certificate in one command\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "4.17.3",
   "title": "Zitadel 4.17.3",
   "notes": "* Zitadel 4.17.3 on Ubuntu 24.04 LTS - identity and access management over OpenID Connect 1.0, OAuth 2.0, SAML 2.0 and SCIM 2.0, with passkeys/WebAuthn, one-time codes, multi-tenant organizations and an event-sourced audit trail\n* Security fixes in this update: identity-provider intent tokens now use authenticated encryption, identity-provider linking is authorized through the enrollment guard rather than session validity, and the authentication-method permission check is made against the user's own organization\n* Also fixed: the authentication and one-time-code strings in the login UI are translated\n* Includes the hosted login UI served under /ui/v2/login on the same origin as the API\n* Bundled PostgreSQL 17 - a complete self-contained deployment, no external database required\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials baked into the image - the administrator password, both PostgreSQL passwords and the encryption master key are generated on this instance at first launch and written to /root/zitadel-credentials.txt\n* Self-registration is disabled, so anonymous visitors cannot create accounts; it can be enabled in the Console\n* HTTPS perimeter on 443 in front of the console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC, with a per-instance certificate generated at first launch\n* PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Usage reporting switched off - nothing leaves the instance\n* Certbot pre-installed for a trusted certificate in one command\n* zitadel-set-domain moves the instance onto your own hostname so the OIDC issuer follows\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "4.17.2",
   "title": "Zitadel 4.17.2",
   "notes": "* Zitadel 4.17.2 on Ubuntu 24.04 LTS - identity and access management over OpenID Connect 1.0, OAuth 2.0, SAML 2.0 and SCIM 2.0, with passkeys/WebAuthn, one-time codes, multi-tenant organizations and an event-sourced audit trail\n* Security fix in this update: a time-based one-time code can no longer be replayed inside its validity window (RFC 6238 section 5)\n* Also fixed: well-known application link files are cached correctly and no longer shared across instances, an absolute IdP URL is no longer prefixed with the base path on a login_hint redirect, unknown users are redirected to the external IdP after domain discovery when enumeration protection is active, the registration organization resolves consistently with the login policy, account selection is shown after an RP-initiated logout, and OrgRoleIDScope downscoping is allowed in token exchange\n* Includes the hosted login UI served under /ui/v2/login on the same origin as the API\n* Bundled PostgreSQL 17 - a complete self-contained deployment, no external database required\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials baked into the image - the administrator password, both PostgreSQL passwords and the encryption master key are generated on this instance at first launch and written to /root/zitadel-credentials.txt\n* Self-registration is disabled, so anonymous visitors cannot create accounts; it can be enabled in the Console\n* HTTPS perimeter on 443 in front of the console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC, with a per-instance certificate generated at first launch\n* PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Usage reporting switched off - nothing leaves the instance\n* Certbot pre-installed for a trusted certificate in one command\n* zitadel-set-domain moves the instance onto your own hostname so the OIDC issuer follows\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-01",
    "azure": "2026-09-02"
   }
  },
  {
   "version": "4.17.1",
   "title": "Zitadel 4.17.1",
   "notes": "* Zitadel 4.17.1 on Ubuntu 24.04 LTS - identity and access management over OpenID Connect 1.0, OAuth 2.0, SAML 2.0 and SCIM 2.0, with passkeys/WebAuthn, one-time codes, multi-tenant organizations and an event-sourced audit trail\n* Security fixes in this update: Login V2 authentication is now blocked for users in deactivated organizations, a permission check is enforced when issuing passkey enrollment codes, and the browser is prevented from requesting OTP codes where it should not\n* Includes the hosted login UI served under /ui/v2/login on the same origin as the API\n* Bundled PostgreSQL 17 - a complete self-contained deployment, no external database required\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials baked into the image - the administrator password, both PostgreSQL passwords and the encryption master key are generated on this instance at first launch and written to /root/zitadel-credentials.txt\n* Self-registration is disabled, so anonymous visitors cannot create accounts; it can be enabled in the Console\n* HTTPS perimeter on 443 in front of the console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC, with a per-instance certificate generated at first launch\n* PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Usage reporting switched off - nothing leaves the instance\n* Certbot pre-installed for a trusted certificate in one command\n* zitadel-set-domain moves the instance onto your own hostname so the OIDC issuer follows\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-18",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "4.16.1",
   "title": "Zitadel 4.16.1 - Initial release (July 2026)",
   "notes": "* Zitadel 4.16.1 on Ubuntu 24.04 LTS - identity and access management over OpenID Connect 1.0, OAuth 2.0, SAML 2.0 and SCIM 2.0, with passkeys/WebAuthn, one-time codes, multi-tenant organizations and an event-sourced audit trail\n* Includes the hosted login UI served under /ui/v2/login on the same origin as the API\n* Bundled PostgreSQL 17 - a complete self-contained deployment, no external database required\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials baked into the image - the administrator password, both PostgreSQL passwords and the encryption master key are generated on this instance at first launch and written to /root/zitadel-credentials.txt\n* Self-registration is disabled, so anonymous visitors cannot create accounts; it can be enabled in the Console\n* HTTPS perimeter on 443 in front of the console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC, with a per-instance certificate generated at first launch\n* PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Usage reporting switched off - nothing leaves the instance\n* Certbot pre-installed for a trusted certificate in one command\n* zitadel-set-domain moves the instance onto your own hostname so the OIDC issuer follows\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-30",
    "azure": "2026-07-31"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.20.0",
   "aws": "2026-10-23"
  },
  {
   "version": "4.19.4",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "4.17.3",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "4.17.2",
   "aws": "2026-09-01",
   "azure": "2026-09-02"
  },
  {
   "version": "4.17.1",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "4.16.1",
   "aws": "2026-07-30",
   "azure": "2026-07-31"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-t7ciekoxedxe6/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer zitadel --plan payg-gen2\naz vm create -g my-rg -n zitadel --size Standard_D2s_v3 \\\n  --image lynxroute:zitadel:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Zitadel is an open-source identity and access management platform: it authenticates your users and issues tokens for your own applications over the standards they already speak. It is a single statically linked Go binary that serves the API and the admin Console, paired with a hosted login UI, and this image bundles the PostgreSQL 17 event store it needs. Feature blocks include OpenID Connect 1.0, OAuth 2.0 with the device and token-exchange flows, SAML 2.0, SCIM 2.0 provisioning, passwords, passkeys/WebAuthn and time-based one-time codes, plus multiple organizations inside one instance for multi-tenant products. Zitadel is event-sourced - every change is appended to an immutable event log in PostgreSQL, so the audit trail is the storage model rather than an add-on, and ordinary PostgreSQL backup and replication tooling applies directly. AGPL-3.0 license, no vendor lock-in: the issuer is a hostname you control, so you can rebuild or move the deployment without every relying party re-integrating.",
  "image_adds": "Security hardening:\n* No credentials are baked into the image - the administrator password, the PostgreSQL application and superuser passwords, and the encryption master key that protects every stored secret are all generated on the instance at first launch and written to /root/zitadel-credentials.txt\n* Self-registration is disabled, so anonymous visitors cannot create their own accounts in your directory; it can be enabled from the Console when you want public sign-up\n* A unique TLS certificate is generated on each instance at first launch, carrying that instance's address - no private key is shared between deployments\n* TLS is terminated at the perimeter on 443 in front of the Console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC; the application ports are not reachable from the network\n* Bundled PostgreSQL 17 bound to 127.0.0.1 only, SCRAM-SHA-256 authentication, no trust authentication anywhere, and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY), which blocks the classic consent-clickjacking attack against an identity provider\n* Usage reporting is switched off - nothing leaves the instance\n* The encryption master key is stored root-only and the login service cannot read it, so a compromise of the login process does not expose stored secrets\n* UFW firewall pre-configured - TCP 22, 80 and 443 open; the API port, the login service port and PostgreSQL blocked\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile\n* auditd, SSH hardening (key-only, no password authentication), Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* AGPL-3.0 license text and the exact upstream revision this image was built from at /usr/share/doc/lynxroute/LICENSES.txt"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}