CVE-2026-29067 - Vulnerability Analysis
HighCVSS: 8.1Last Updated: March 7, 2026
ZITADEL - Open Redirect
Published: March 7, 2026Updated: March 7, 2026Remote Exploitable
Overview
ZITADEL 4.0.0-rc.1 to 4.7.0 contains an open redirect vulnerability caused by using untrusted Forwarded or X-Forwarded-Host headers to construct password reset confirmation URLs, letting attackers redirect users via crafted links, exploit requires sending crafted requests.
Severity & Score
Severity: High
CVSS Score: 8.1
Impact
Attackers can redirect users to malicious sites via password reset links, potentially leading to phishing or credential theft.
Mitigation
Upgrade to version 4.7.1 or later.
Related Resources
Details
- CVE ID
- CVE-2026-29067
- Severity
- High
- CVSS Score
- 8.1
- Type
- open_redirect
- Status
- new
CWE
- CWE-601
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N