Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.
该漏洞已被公开披露并确认在野利用；具体受影响产品与版本以 NVD 记录和厂商安全公告为准。
该漏洞或治理动作已公开。建议核对资产是否使用受影响产品，按厂商公告升级或缓解；检查日志中的异常利用痕迹；无法立即修复时先限制暴露面。
史料来源与许可：部分史料来自维基百科（CC BY-SA 4.0）、DBpedia（CC BY-SA 3.0）、NVD 与 CISA 公开数据，遵循各自许可；原始链接见「参考来源」。
漏洞公开后，攻击者通常会快速跟进利用。是否受影响取决于产品版本、暴露面与缓解措施，建议先完成资产核对，再决定修复顺序。
以上为通用研判，具体受影响产品、版本与利用条件以 NVD、CISA 和厂商公告为准。
0–24 小时
1–7 天
持续
Known Exploited Vulnerabilities 目录，由美国 CISA 维护，只收录已确认被在野利用的漏洞，并要求联邦机构按期限修复。
代表漏洞首次公开披露的年份，不代表它被收录进 KEV 的时间。旧 CVE 也可能在之后被确认利用并纳入 KEV。
先确认是否使用受影响产品与版本；若在用，优先按厂商公告升级或缓解。KEV 条目建议按高优先级处理。
采用临时缓解：限制网络暴露、关闭受影响功能、增加访问控制与检测规则，并持续关注厂商更新。