CVE-2025-64101

{
  "id": "CVE-2025-64101",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-29T19:15:38.763",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."
    },
    {
      "lang": "es",
      "value": "Zitadel es software de infraestructura de identidad de código abierto. Antes de las versiones 4.6.0, 3.4.3 y 2.71.18, existe una potencial vulnerabilidad en el mecanismo de restablecimiento de contraseña de ZITADEL. ZITADEL utiliza el encabezado Forwarded o X-Forwarded-Host de las solicitudes entrantes para construir la URL del enlace de confirmación de restablecimiento de contraseña. Este enlace, que contiene un código secreto, se envía luego por correo electrónico al usuario. Si un atacante puede manipular estos encabezados (por ejemplo, mediante inyección de encabezado de host), podría hacer que ZITADEL genere un enlace de restablecimiento de contraseña que apunte a un dominio malicioso controlado por el atacante. Si el usuario hace clic en este enlace manipulado en el correo electrónico, el código secreto de restablecimiento incrustado en la URL puede ser capturado por el atacante. Este código capturado podría usarse luego para restablecer la contraseña del usuario y obtener acceso no autorizado a su cuenta. Es importante señalar que este vector de ataque específico se mitiga para las cuentas que tienen la autenticación multifactor (MFA) o la autenticación sin contraseña habilitada. Esta vulnerabilidad está corregida en las versiones 4.6.0, 3.4.3 y 2.71.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "version": ">= 4.0.0-rc.1, < 4.6.0",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0-rc.1, < 3.4.3",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0, < 2.71.18",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-29T19:35:29.013422Z",
          "id": "CVE-2025-64101",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        },
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.71.18",
              "matchCriteriaId": "CC5B40B7-D194-4612-84F5-9EE0477D1492"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndExcluding": "3.4.3",
              "matchCriteriaId": "71F16C15-7BC0-48BF-94CA-A0675AE8144E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.6.0",
              "matchCriteriaId": "EBBE21CE-7517-4843-AD68-281A0254BC26"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}