Vulnerability details

CVE-2026-29067

zitadel zitadel

ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

CVSS 3.1

8.1High

Official description

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.

CVSS scores

Score	Version	Source	Vector
8.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
zitadel	zitadel	>= 4.0.0-rc.1, < 4.7.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-07
Last updated: 2026-03-09
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')