High · published October 29, 2025
⚡ Just one sneaky header could let the bad guys reset your password! Before Zitadel version 4.6.0, an attacker could craft a malicious password reset link using the X-Forwarded-Host header. 🔥 Think of it like a restaurant sending you a confirmation email for a reservation, but the address links to a fake eatery instead of the real one! If you're not careful, you'll show up to the wrong place and lose control of your dining experience (or in this case, your account). If exploited, an attacker could capture the secret code embedded in the manipulated password reset link, allowing them to reset the user’s password and gain unauthorized access to their account. This could lead to an absolute nightmare, as sensitive information could be compromised and accounts hijacked!
Think of it like a restaurant sending you a confirmation email for a reservation, but the address links to a fake eatery instead of the real one! If you're not careful, you'll show up to the wrong place and lose control of your dining experience (or in this case, your account). This vulnerability exists because Zitadel uses untrusted input from the Forwarded or X-Forwarded-Host header to construct the password reset confirmation link, which can be manipulated by attackers using host header injection techniques.
If exploited, an attacker could capture the secret code embedded in the manipulated password reset link, allowing them to reset the user’s password and gain unauthorized access to their account. This could lead to an absolute nightmare, as sensitive information could be compromised and accounts hijacked! Update to Zitadel version 4.6.0, 3.4.3, or 2.71.18 immediately to patch this vulnerability. If possible, enable Multi-Factor Authentication (MFA) or Passwordless authentication to further protect your accounts from unauthorized access. You've got this! Just follow the steps, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zitadel/zitadel | < 2.71.18 | 2.71.18 |
| zitadel/zitadel | ≥ 3.0.0, < 3.4.3 | 3.4.3 |
| zitadel/zitadel | ≥ 4.0.0, < 4.6.0 | 4.6.0 |