Threats tagged 'ghsa-mwmh-7px9-4c23'

ZITADEL versions 2.0.0 through 2.71.17, 3.0.0 through 3.4.2, and 4.0.0 through 4.5.0 are vulnerable to an account takeover via malicious header injection. The vulnerability arises because ZITADEL uses the Forwarded or X-Forwarded-Host HTTP headers to build password reset confirmation links. An attacker who can manipulate these headers can cause the reset link to point to a malicious domain, capturing the secret reset code and potentially resetting the user's password. Accounts with Multi-Factor Authentication or Passwordless authentication are protected against this attack. Patched versions are available that validate these headers properly.