CVE-2026-29067 - Vulnerability Analysis

Overview

ZITADEL 4.0.0-rc.1 to 4.7.0 contains an open redirect vulnerability caused by using untrusted Forwarded or X-Forwarded-Host headers to construct password reset confirmation URLs, letting attackers redirect users via crafted links, exploit requires sending crafted requests.

Severity & Score

Impact

Attackers can redirect users to malicious sites via password reset links, potentially leading to phishing or credential theft.

Mitigation

Upgrade to version 4.7.1 or later.

References

• https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-29067 - High (8.1) ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming r... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29067/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner