CVE-2026-29067 Details

A vulnerability has been identified in ZITADEL's password reset process within the login V2 interface, affecting versions 4.0.0-rc.1 through 4.7.0. The issue arises because ZITADEL uses the Forwarded or X-Forwarded-Host headers from incoming requests to create the password reset confirmation link. This link, which includes a secret code, is emailed to the user. If an attacker can manipulate these headers, they could redirect the password reset link to a domain they control, potentially leading to unauthorized access to the user's account. This vulnerability is particularly concerning as it bypasses standard authentication measures, although accounts with Multi-Factor Authentication or Passwordless authentication enabled are not at risk.

Users are advised to update ZITADEL to version 4.7.1 or later. In self-hosted environments, ensure that the ZITADEL_API_URL is correctly set and that the HTTP host or X-Forwarded-Host is passed through the reverse proxy to the login UI. For multi-instance deployments, a X-ZITADEL-INSTANCE-HOST or X-ZITADEL-FORWARDED-HOST should be set in the reverse proxy.