A vulnerability in the Zitadel password reset mechanism allows unauthenticated attackers to hijack user accounts through host header manipulation, necessitating an immediate update.

The application incorrectly utilizes the Forwarded or X-Forwarded-Host header to construct password reset confirmation links. This unauthenticated flaw allows an attacker to generate a link pointing to a malicious domain, enabling the interception of secret reset codes when a user clicks the link.

Successful exploitation allows unauthorized account takeover, which can lead to significant data breaches and compromise of sensitive identity infrastructure. With a CVSS score of 8.1, the vulnerability presents a high risk to organizational security, particularly for environments relying on Zitadel for centralized authentication services.

Immediate Action: Upgrade to Zitadel versions 4.6.0, 3.4.3, or 2.71.18 immediately to apply the required fix for header handling.

Proactive Monitoring: Review web access logs for anomalous requests containing modified Host, Forwarded, or X-Forwarded-Host headers.

Compensating Controls: Enforce Multi-Factor Authentication (MFA) or passwordless authentication for all user accounts, as these methods effectively mitigate this specific attack vector.

Public Exploit Available: No

This vulnerability represents a critical risk to identity integrity due to the potential for full account takeover. Administrators must prioritize updating to the patched versions listed above. If an immediate update is not feasible, ensure all user accounts have MFA enabled to neutralize the risk of password reset interception.