ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
Résumé
ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov