CVE-2026-29067
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- EPSS probability
- 0.32%
- CWE
- CWE-601
- Published
- 2026-03-07
- Last modified
- 2026-03-16
Affected products
- zitadel zitadel
Weakness type
Related vulnerabilities
- CVE-2026-86756 — Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
- CVE-2026-78377 — Open Redirect in Yordam Informatics's Library Automation System
- CVE-2026-84389 — A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0...
- CVE-2026-86351 — MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
- CVE-2026-86256 — wger before 2.6 Open Redirect via trainer-login next parameter
- CVE-2026-86205 — h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
- CVE-2026-85676 — Dub Open Redirect via Unrestricted redir_url Parameter
- CVE-2026-53728 — Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage