CVE-2026-29067: Zitadel Auth Bypass Vulnerability

CVE-2026-29067 Overview

CVE-2026-29067 is an Open Redirect vulnerability (CWE-601) in ZITADEL, an open source identity management platform. The vulnerability exists in ZITADEL's password reset mechanism within login V2, where the application uses the Forwarded or X-Forwarded-Host header from incoming HTTP requests to construct the URL for password reset confirmation links. These links, containing secret reset codes, are then emailed to users. An attacker who can manipulate these headers could redirect password reset links to a malicious domain, potentially capturing sensitive reset tokens.

Critical Impact

Attackers can hijack password reset tokens by manipulating HTTP host headers, enabling account takeover of any ZITADEL user who initiates a password reset.

Affected Products

• ZITADEL versions 4.0.0-rc.1 through 4.7.0

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-29067 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-29067

Vulnerability Analysis

This vulnerability represents a classic Host Header Injection flaw combined with an Open Redirect weakness. When a user requests a password reset, ZITADEL's login V2 component reads the Forwarded or X-Forwarded-Host header from the incoming HTTP request and uses this value to construct the base URL for the password reset link. This design decision creates a trust boundary violation where user-controlled input directly influences security-sensitive URL generation.

The constructed URL contains a secret code that authenticates the password reset action. By poisoning the host header, an attacker can cause ZITADEL to generate and email a password reset link pointing to an attacker-controlled domain. When the victim clicks this link, the secret reset code is transmitted to the attacker's server, allowing them to complete the password reset process and take over the victim's account.

Root Cause

The root cause is improper validation and trust of HTTP headers used in security-critical URL construction. The X-Forwarded-Host and Forwarded headers are designed for use by reverse proxies to communicate the original host requested by the client. However, in many deployment scenarios, these headers can be directly controlled by attackers. ZITADEL's login V2 component failed to validate these headers against an allowlist of trusted domains before using them to construct password reset URLs, creating a path for attackers to redirect sensitive password reset links to malicious domains.

Attack Vector

The attack is network-based and requires minimal attacker privileges but does require user interaction. An attacker initiates a password reset request for a target user's email address while injecting a malicious host header value. The attack flow proceeds as follows:

1. Attacker sends a password reset request to ZITADEL with a manipulated X-Forwarded-Host header pointing to attacker.com
2. ZITADEL generates a password reset link using the attacker-controlled host value
3. The victim receives an email with the poisoned reset link containing the secret code
4. When the victim clicks the link, they are directed to the attacker's domain
5. The attacker captures the secret code from the URL and uses it to reset the victim's password

The vulnerability requires no authentication to exploit, though user interaction (clicking the malicious link) is necessary for successful exploitation.

Detection Methods for CVE-2026-29067

Indicators of Compromise

• Anomalous X-Forwarded-Host or Forwarded header values in HTTP logs that don't match legitimate proxy configurations
• Password reset emails containing URLs with unexpected or external domain names
• Unexpected password reset requests originating from unusual IP addresses or geographic locations
• User reports of password reset emails with suspicious links

Detection Strategies

• Monitor web server and application logs for HTTP requests containing unexpected X-Forwarded-Host or Forwarded header values
• Implement alerting for password reset URL generation that references domains outside of the configured allowlist
• Deploy web application firewalls (WAF) with rules to detect and block host header manipulation attempts
• Review email logs for password reset messages containing external domain references

Monitoring Recommendations

• Enable verbose logging for ZITADEL's login V2 component to capture all incoming headers on password reset endpoints
• Configure SIEM rules to correlate password reset requests with unusual header patterns
• Monitor for spikes in password reset failures that may indicate exploitation attempts
• Implement real-time alerting for any password reset URLs containing non-whitelisted domains

How to Mitigate CVE-2026-29067

Immediate Actions Required

• Upgrade ZITADEL to version 4.7.1 or later immediately
• Audit recent password reset activity for signs of exploitation
• Review proxy and load balancer configurations to ensure proper header handling
• Consider implementing additional host header validation at the reverse proxy level

Patch Information

ZITADEL has released version 4.7.1 which addresses this vulnerability. The patch implements proper validation of the Forwarded and X-Forwarded-Host headers against trusted domain configurations before using them in URL construction. Organizations running affected versions (4.0.0-rc.1 through 4.7.0) should upgrade immediately.

For detailed patch information and upgrade instructions, see the ZITADEL Security Advisory.

Workarounds

• Configure your reverse proxy or load balancer to strip or sanitize X-Forwarded-Host and Forwarded headers from untrusted sources before they reach ZITADEL
• Implement a web application firewall rule to block requests with host headers that don't match your legitimate domain configuration
• Consider disabling password reset functionality temporarily if immediate patching is not possible

# Example nginx configuration to restrict X-Forwarded-Host
# Add to your nginx server block proxying to ZITADEL
proxy_set_header X-Forwarded-Host $host;
proxy_set_header Host $host;
# Ensure only the configured host value is passed, ignoring client-supplied headers