ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.19.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ZITADEL, an open-source identity and access management platform, is affected before version 4.19.5 in its Login V2 user interface. An unauthenticated attacker can manipulate host headers so that password-reset, invitation, and email-verification links point to an attacker-controlled host, allowing them to capture the codes and take over victim accounts, including instance administrator accounts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- zitadel zitadel
From 4.0.0 · fixed in 4.19.5