Threats tagged 'ghsa-47m4-8jqx-5r73'

ZITADEL versions from 4.0.0 up to but not including 4.19.5 contain a host header injection vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to manipulate certain HTTP headers to poison password-reset, invite, and email-verification links. By exploiting this, attackers who know a victim's login name can redirect these links to their own host, intercept single-use codes, and potentially take over user accounts, including those of instance administrators.