The increasing interest in Central Bank Digital Currencies has heightened the need for the suitable security technologies for preserving the privacy of users of the CBDC. Although the CBDC system architecture is deeply related to the legacy payment system and the public blockchain system, security and privacy issues of the CBDC are completely different from those of the existing systems as the purpose of the CBDC is to achieve auditable privacy. We demonstrate the taxonomy of the security and privacy issues in CBDC system according to the following areas: identity, transaction, consensus and auditability. We also emphasize the research gaps in the fields stem from the CBDC’s unique characteristics including the authorized audit risk problem and the cross-border payments problem. This study contributes to the current understanding of the security and privacy concerns of CBDCs and addresses the remaining gaps in this field of research.