CVE-2026-29067 is a high severity (CVSS 8.1) flaw in ZITADEL login V2, from 4.0.0-rc.1 through 4.7.0. The password reset link in the email is built from the Forwarded or X-Forwarded-Host header, which an attacker may control. The fix is version 4.7.1.
What's affected
The GitHub advisory lists v4.x from 4.0.0-rc.1 through 4.7.0 as affected when you use the login UI (V2), and 4.7.1 as the fixed version. Its structured data also lists some earlier module version ranges, so read the advisory if you run an older line.
The advisory says the attack is mitigated for accounts that have multi-factor authentication or passwordless authentication enabled.
How to check if you're exposed
Check the ZITADEL version in your deployment, for example from the image tag. Then confirm you use login V2. The advisory lists settings to verify before you upgrade:
ZITADEL_API_URLis set and points to your instance (or system, in multi-instance setups).- Your reverse proxy passes the HTTP host, or
x-forwarded-host, to the login UI. - An
x-zitadel-instance-hostorx-zitadel-forward-hostheader is set as described in the advisory.
Read the full advisory for the exact header names for your setup.
What to do now
- Review the pre-upgrade checks in the advisory (API URL, host headers).
- Upgrade ZITADEL to 4.7.1 or later.
- Configure your reverse proxy so clients cannot supply their own forwarding headers, and only your proxy sets them.
- Encourage or require multi-factor or passwordless login, which the advisory says blocks this vector.
- Check email logs for reset messages with unexpected domains.
Why it matters
The record lists CWE-601, a redirect to an untrusted site, though the mechanism is closer to host header injection. The server used a header from the request to build a link that it then emailed. If an attacker can set that header, the email carries a link to their domain, with the user's secret reset code inside it.
The attack still needs the user to click, which is why the CVSS vector lists user interaction. But a message from your own identity provider, with real branding, is persuasive. The patch validates the forwarded host headers against the instance's trusted domains.
The general rule: never build security links from request headers unless you validate them against an allowlist of your own domains. The record does not mark the CVE as exploited in the wild.
Quick check
Why does MFA help here?
The advisory says the attack is mitigated for accounts with multi-factor or passwordless login, because a stolen reset code alone is not enough to take over such accounts.
Sources
Last reviewed: 19 October 2026.
