GHSA-pm3x-9hh8-g745

ZITADEL’s hosted Login V2 UI allowed an unauthenticated attacker to craft a link on the instance’s own domain whose “Back to Login” button leads to an attacker-controlled website. Two error pages that Login V2 shows after a sign-in with an external identity provider took the destination of that button from the link itself, without checking that it points back into the login UI.

An attacker who can send a link to a victim can:

• Craft a phishing link on the trusted ZITADEL domain that shows a genuine, branded “account not found” or “registration failed” page and whose “Back to Login” button navigates to a site of the attacker’s choice.
• Show an organization’s branding on the page, so it looks like the victim’s usual login.

This affects applications that authenticate users through ZITADEL’s hosted Login V2 UI (OIDC/SAML).

The issue does not leak any session, token, code or other secret: the navigation to the attacker’s site is a plain click on a link and carries nothing from the…