NIXPKGS-2026-0574

GitHub issue published on 8 Mar 2026

Permalink CVE-2026-29067

updated 1 week ago by @mweinelt Activity log

Created automatic suggestion 1 week ago
@mweinelt removed package zitadel-tools 1 week ago
@mweinelt accepted 1 week ago
@mweinelt published on GitHub 1 week ago

ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.

References

https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5 x_refsource_CONFIRM

Affected products

zitadel

==>= 4.0.0-rc.1, < 4.7.1

Matching in nixpkgs

pkgs.zitadel

Identity and access management platform

nixos-unstable 2.71.7
- nixpkgs-unstable 2.71.7
- nixos-unstable-small 2.71.7
nixos-25.11 2.71.7
- nixos-25.11-small 2.71.7
- nixpkgs-25.11-darwin 2.71.7

Ignored packages (1)

pkgs.zitadel-tools

Helper tools for zitadel

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-25.11 0.5.0
- nixos-25.11-small 0.5.0
- nixpkgs-25.11-darwin 0.5.0

Package maintainers

@nrabulinski Nikodem Rabuliński <1337-nix@nrab.lol>

Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5