Description

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.

INFO

Published Date :

2026-03-07T15:12:26.345Z

Last Modified :

2026-03-09T18:27:24.567Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-29067 vulnerability.

Vendors Products
Zitadel
  • Zitadel
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-29067.

URL Resource
https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact