ZITADEL vulnerable account takeover via malicious host header injection

CVE-2023-49097

Summary

ZITADEL's identity infrastructure is susceptible to an improper input validation issue due to the mismanagement of the 'Forwarded' or 'X-Forwarded-Host' headers. This security flaw allows an attacker to craft a malicious link for password reset emails. When an unsuspecting user clicks the manipulated link, their secret code is exposed, facilitating unauthorized access to their account. Notably, accounts secured with Multi-Factor Authentication (MFA) or Passwordless authentication methods remain protected against this vulnerability. It is essential for users of ZITADEL to update to versions 2.41.6, 2.40.10, or 2.39.9 to mitigate this risk.

References