ZITADEL
CVE-2025-64101
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInject malicious X-Forwarded-Host header
-
DeliveryTrigger victim's password reset email
-
ExploitZitadel emails reset link to attacker domain
-
ExecutionVictim clicks, secret code captured
-
ImpactReset password and take over account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the attacker can get a crafted Forwarded or X-Forwarded-Host header to reach Zitadel unmodified (i.e. no fronting proxy stripping/normalizing these headers, which is the vendor-recommended workaround), knowledge of a target's username/email to trigger the password-reset flow, and that the victim clicks the resulting link in the reset email (UI:R). Exploitation is explicitly blocked for accounts with Multi-Factor Authentication or Passwordless (passkey) enabled, since the stolen reset code alone cannot satisfy the second factor. The realistic victim population is therefore password-only accounts on self-hosted or directly-exposed instances; enforced MFA and a header-sanitizing reverse proxy each neutralize the attack. |
| Impact | All signals point to a genuinely serious but condition-dependent flaw rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) correctly reflects network reach, no attacker privileges, and full account compromise, but the UI:R metric is load-bearing: the victim must click the poisoned password-reset link. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC referenced in the input, and no EPSS score was provided, so widespread opportunistic exploitation cannot be inferred from the data. The patch is confirmed available (vendor commit 72a5c33e and advisory GHSA-mwmh-7px9-4c23). Two factors materially reduce real-world risk below the raw 8.8: the vendor explicitly states accounts with MFA or Passwordless are NOT vulnerable to this vector, and many production deployments sit behind a fronting reverse proxy - the recommended workaround is to strip Forwarded/X-Forwarded-Host headers, and common proxy configurations already normalize them. Net: a high-priority patch for any Zitadel operator with password-only accounts and direct header exposure, but not a drive-by, auth-less, zero-interaction compromise. |
| Exploit ScenarioDerived | An attacker initiates a password reset for a known victim account while sending a crafted Forwarded or X-Forwarded-Host header; Zitadel builds the reset-confirmation URL from that header, so the emailed link points to an attacker-controlled domain while still carrying the valid secret reset code. When the victim clicks the link, the attacker captures the code and uses it to set a new password and take over the account. No public exploit code is referenced in the input, and success requires the victim to click and the account to lack MFA/Passwordless. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Zitadel's password reset flow builds the emailed confirmation URL from the request's Forwarded or X-Forwarded-Host header, so an attacker who can inject a forged host value can make the reset link point at a domain they control and harvest the embedded secret code when the victim clicks it, leading to account takeover. Affected are self-hosted deployments prior to 4.6.0, 3.4.3, and 2.71.18, with impact also shown in versions as old as 2.71.17 and 3.4.2; unauthenticated remote attackers (CVSS 3.1 PR:N) are the relevant threat, though the attack requires victim interaction (UI:R) and knowledge of the target's email address. Accounts protected by MFA or Passwordless are explicitly out of reach because the stolen reset code alone cannot satisfy the second factor, and no public exploit code or CISA KEV confirmation is present at time of analysis - risk is real but condition-dependent, concentrated on password-only accounts behind no header-sanitizing proxy.
RemediationAI
Vendor-released patches: upgrade to Zitadel 4.6.0 or later on the 4.x line, 3.4.3 or later on the 3.x line, or 2.71.18 or later on the 2.x line (release links: https://github.com/zitadel/zitadel/releases/tag/v4.6.0, .../tag/v3.4.3, .../tag/v2.71.18). Where upgrading is delayed, the vendor's documented workaround is to configure the fronting reverse proxy or load balancer to strip all Forwarded and X-Forwarded-Host headers before forwarding to Zitadel and to rebuild the correct host from the proxy's own trusted configuration - trade-off: multi-tenant instance resolution and any legitimate absolute-URL generation depend on the proxy supplying the right Host value, so this must be tested on non-production tenants first. As a complementary control, enforce MFA or Passwordless (passkey) for all users, which the advisory explicitly states neutralizes this attack vector - trade-off is user enrollment friction and recovery-flow support. Rate-limiting and monitoring password-reset requests for anomalous header values, plus alerting on reset emails whose links point to unexpected domains, reduce exposure while patching is staged. Directly exposing Zitadel to the internet without a header-sanitizing proxy should be avoided.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zitadel is a Go-based open-source identity and access management platform (OIDC/OAuth2/SAML identity provider with multi-tenant 'instance' support). It routes incoming requests to the correct tenant instance by inspecting host-related headers, and it reuses the same Forwarded / X-Forwarded-Host values to compose absolute links for out-of-band flows such as password resets. That conflates untrusted request input with trusted routing and link generation, which is the classic CWE-601 (URL Redirection to Untrusted Site / open redirect) pattern, here weaponized because the redirect target carries a bearer-like secret. The upstream fix (commit 72a5c33e6ac) does two things: it switches instance lookup from the raw host (hostname[:port]) to a parsed instanceDomain, and it introduces a sanitizeHost helper in the origin interceptor that splits host and port with net.SplitHostPort, rejects non-numeric or out-of-range ports (defeating payloads like 'localhost:@attacker.com'), and drops malformed headers with a logged warning instead of forwarding them. In other words, the patch treats the header as untrusted data rather than trusted routing input. The vulnerable pattern only exists where the Go middleware receives attacker-controlled values, i.e. where something in front of Zitadel does not overwrite or strip these headers - the vendor workaround explicitly instructs fronting proxies to delete all Forwarded and X-Forwarded-Host values before forwarding.
Know when Zitadel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote with no privileges, but the victim must click the poisoned reset link (UI:R); successful takeover yields full account control, hence C:H/I:H/A:H with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.
Executive ViewAI
Self-hosted Zitadel identity deployments running versions older than 4.6.0, 3.4.3, or 2.71.18 contain a password-reset weakness that lets an attacker redirect reset links to a domain they control and capture the embedded secret, enabling takeover of password-only accounts. Leadership should care because Zitadel is the authentication front door to workforce SSO, email, and connected SaaS; a single compromised privileged account can cascade across the estate. Reach is narrowed by the need for victim interaction, prior knowledge of the target's email address, absence of header-sanitizing reverse proxies, and lack of MFA or Passwordless on the account, but remediation is a routine version upgrade.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Zitadel is open-source identity infrastructure software. Rated critical severity (CVSS 9.1), this vulnerability is remot
ZITADEL is an identity infrastructure system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Authentication bypass in ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 lets an authenticated attacker with organizati
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated r
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker
Stored XSS in ZITADEL identity management platform versions 4.0.0 to 4.11.1 allows unauthenticated attackers to inject p
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim'
Authentication bypass in ZITADEL's Login V2 UI (versions 3.0.0 through 4.19.1) allows unauthenticated attackers to take
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected a
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Ra
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Ra
Unauthenticated username-change in ZITADEL's hosted Login V1 UI lets a remote attacker rename any active human account -
Exploit-DB