CVE-2026-29067: 
NixOS vulnerability analysis and mitigation

CVE-2026-29067 is a host header injection vulnerability in ZITADEL's password reset mechanism (Login V2) that enables account takeover via open redirect and credential phishing. Affecting ZITADEL versions 4.0.0-rc.1 through 4.7.0, the flaw allows an attacker to manipulate the Forwarded or X-Forwarded-Host HTTP headers to cause ZITADEL to generate password reset links pointing to an attacker-controlled domain. The vulnerability was published on March 7, 2026, and patched in version 4.7.1. It carries a CVSS v3.1 base score of 8.1 (High) per the GitHub Security Advisory, though Feedly reports a score of 9.3 (Critical) under a changed-scope calculation (GitHub Advisory, Red Hat CVE).

The root cause is improper validation of the Forwarded and X-Forwarded-Host HTTP headers (CWE-601: URL Redirection to Untrusted Site / Open Redirect). When a password reset is initiated, ZITADEL's Login V2 UI uses these headers to construct the confirmation URL embedded in the reset email, without verifying that the host value matches a trusted or configured instance domain. An attacker who can inject a crafted X-Forwarded-Host header into the password reset request — for example, by sending the request directly or via a misconfigured proxy — can cause the generated reset link to point to an arbitrary attacker-controlled domain. The secret reset code is included in this URL, and if the victim clicks the link, the code is delivered to the attacker. Notably, accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled are partially protected, as the captured reset code alone is insufficient for full account takeover in those cases (GitHub Advisory).

Successful exploitation allows an attacker to capture a victim's password reset token and use it to reset the user's password, resulting in full account takeover and unauthorized access to the ZITADEL identity platform. This has high confidentiality and integrity impact — an attacker gains access to the victim's identity and all resources protected by it. Availability is not directly impacted. Accounts protected by MFA or Passwordless authentication have a reduced risk of full account takeover, but are still susceptible to phishing via the malicious reset link (GitHub Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.011% (0.000110), indicating a very low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must click the malicious password reset link — which limits opportunistic mass exploitation.

1. Reconnaissance: Identify a ZITADEL instance running Login V2 (versions 4.0.0-rc.1 through 4.7.0) that is accessible over the network and has password reset functionality enabled.
2. Initiate password reset: Send a password reset request for a target user account to the ZITADEL Login V2 password reset endpoint.
3. Inject malicious host header: Include a crafted X-Forwarded-Host or Forwarded header in the HTTP request, setting the host value to an attacker-controlled domain (e.g., X-Forwarded-Host: attacker.example.com).
4. Victim receives malicious email: ZITADEL generates the password reset confirmation URL using the injected host, embedding the secret reset code in a link pointing to attacker.example.com. This link is emailed to the target user.
5. Capture reset token: When the victim clicks the link, their browser sends the request (including the secret reset code in the URL) to the attacker's server, where it is logged.
6. Account takeover: The attacker uses the captured reset code against the legitimate ZITADEL instance to reset the victim's password and gain unauthorized access to their account (effective only if MFA/Passwordless is not enabled) (GitHub Advisory).

• Network: Outbound password reset email links containing a host domain that does not match the configured ZITADEL instance domain; HTTP requests to the ZITADEL password reset endpoint containing unexpected or external values in X-Forwarded-Host or Forwarded headers.
• Logs: ZITADEL access logs showing password reset requests with X-Forwarded-Host or Forwarded header values differing from the legitimate instance hostname; password reset tokens being redeemed from IP addresses or user agents inconsistent with the original requester.
• Application Behavior: Password reset confirmation links in outbound emails pointing to domains not owned or configured by the organization; unexpected password changes on user accounts shortly after password reset emails are sent.

Upgrade ZITADEL to version 4.7.1 or later, which resolves the issue by correctly validating X-Forwarded-Host and Forwarded headers against the instance's configured custom and trusted domains. Before upgrading, ensure ZITADEL_API_URL is set and points to the correct instance, and that the HTTP host (or x-forwarded-host) is properly passed by any reverse proxy to the Login UI. As a workaround for environments that cannot immediately upgrade, configure a fronting reverse proxy to strip or overwrite all Forwarded and X-Forwarded-Host header values with the legitimate host before forwarding requests to ZITADEL. Additionally, enabling MFA or Passwordless authentication for user accounts significantly reduces the risk of full account takeover even if the reset token is captured (GitHub Advisory).

The vulnerability was discovered and reported by Amit Laish of GE Vernova, and coordinated through GitHub's security advisory process by the ZITADEL security team. A technical write-up titled "ZITADEL Account Takeover Due to Improper Instance Validation in V2 Login" was published by Infinit Security shortly after disclosure (Infinit Security). No significant broader media coverage or notable social media reactions have been identified beyond standard CVE tracking and aggregator coverage.