ZITADEL versions 4.0.0‑rc.1 through 4.7.0 construct the email confirmation link for password resets using the Forwarded or X-Forwarded-Host header from incoming requests. This header is used to build the full URL that contains a secret reset code and is sent to the user. Because the header can be manipulated, an attacker can generate a link that points to an attacker-controlled domain or modifies the path to the confirmation endpoint, enabling account takeover by tricking a user into confirming the reset under the attacker's control.

The affected product is ZITADEL, an open source identity management platform, with vulnerability present only in releases between 4.0.0‑rc.1 and 4.7.0 inclusive. Versions 4.7.1 and later contain the patch.

The CVSS score is 8.1, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting a low but non‑zero probability of exploitation in the current data snapshot. The CVE is not listed in the CISA KEV catalog. Exploitation requires an attacker to control or influence the Forwarded/X-Forwarded-Host header in traffic to ZITADEL, which can occur via misconfigured reverse proxies, load balancers, or internal networks. Once the attacker induces a password‑reset email that uses a forged host, they can direct the user to a malicious confirmation page to hijack the account.