Security Advisory

CVE-2026-29067

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-07 15:12:26

Last updated 2026-03-09 18:27:24

Assigner GitHub_M

State PUBLISHED

Description

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADELs password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.

← Browse all CVEs View on cve.org ↗