GHSA-qvxq-53gh-64f6

ZITADEL allowed an unauthenticated attacker who knows only a victim’s login name to redirect that victim’s genuine password-reset, invite, and email-verification links to an attacker-controlled host, while the links still carried the real single-use codes. Harvesting such a code lets the attacker set a new password — or complete verification — and sign in as the victim, including an instance administrator. This is a bypass of the fix for GHSA-mchc-246r-6m76.

The fix for GHSA-mchc-246r-6m76 validates the public host from the x-zitadel-public-host request header against the instance’s trusted domains. However, the trusted-domain check and the links read the header value differently: a value that places a trusted host in the user-information portion of the header, in front of an attacker-controlled host, was checked as the trusted host, while a link built from the same value points to the attacker host.