Description
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5
Scores
CVSS v3
8.1
EPSS
0.0032
EPSS Percentile
23.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-601
Status
published
Products (2)
zitadel/zitadel
0 - 1.80.0-v2.20.0.20251208091519-4c879b47334e (2 CPE variants)Go
zitadel/zitadel
4.0.0 - 4.7.1
Published
Mar 07, 2026
Tracked Since
Mar 07, 2026