TI-2023-26762 Aliases CVE-2023-49097 GHSA-2wmj-46rj-qm2w

ZITADEL vulnerable account takeover via malicious host header injection

MEDIUM 41CWE-640Published 2023-11-30 · Updated 2024-11-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00767 55th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed zitadel (zitadel): 2.39.9, 2.40.10, 2.41.6github.com/zitadel/zitadel (Go): 2.39.9, 2.40.10, 2.41.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zitadel	zitadel	2.39.0 to before 2.39.9; 2.40.0 to before 2.40.10; 2.41.0 to before 2.41.6	2.39.9, 2.40.10, 2.41.6	Patch available	CNA
—	github.com/zitadel/zitadel (Go)	2.39.0 to before 2.39.9	2.39.9	Patch available	GHSA-2wmj-46rj-qm2w
—	github.com/zitadel/zitadel (Go)	2.40.0 to before 2.40.10	2.40.10	Patch available	GHSA-2wmj-46rj-qm2w
—	github.com/zitadel/zitadel (Go)	2.41.0 to before 2.41.6	2.41.6	Patch available	GHSA-2wmj-46rj-qm2w

zitadel Vendorzitadel Affected 2.39.0 to before 2.39.9; 2.40.0 to before 2.40.10; 2.41.0 to before 2.41.6 Fixed in 2.39.9, 2.40.10, 2.41.6 Patch available CNA
github.com/zitadel/zitadel (Go) Vendor— Affected 2.39.0 to before 2.39.9 Fixed in 2.39.9 Patch available GHSA-2wmj-46rj-qm2w
github.com/zitadel/zitadel (Go) Vendor— Affected 2.40.0 to before 2.40.10 Fixed in 2.40.10 Patch available GHSA-2wmj-46rj-qm2w
github.com/zitadel/zitadel (Go) Vendor— Affected 2.41.0 to before 2.41.6 Fixed in 2.41.6 Patch available GHSA-2wmj-46rj-qm2w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zitadel:zitadel::::::::	2.39.0 to before 2.39.9; 2.40.0 to before 2.40.10; 2.41.0 to before 2.41.6	Vulnerable	zitadel

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 2.39.0 to before 2.39.9; 2.40.0 to before 2.40.10; 2.41.0 to before 2.41.6 Vulnerable ·zitadel

Remediation

Fix · CNA zitadel (zitadel) Fixed in 2.39.9, 2.40.10, 2.41.6
Fix · GHSA-2wmj-46rj-qm2w github.com/zitadel/zitadel (Go) Fixed in 2.39.9 Advisory →
Fix · GHSA-2wmj-46rj-qm2w github.com/zitadel/zitadel (Go) Fixed in 2.40.10 Advisory →
Fix · GHSA-2wmj-46rj-qm2w github.com/zitadel/zitadel (Go) Fixed in 2.41.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-49097
2026-10-03 Alias added: GHSA-2wmj-46rj-qm2w

References

TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences