CVE-2025-64101 (CNNVD-202510-3960)
中文标题:
ZITADEL 授权问题漏洞
英文标题:
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection
漏洞描述
中文描述:
ZITADEL是瑞士ZITADEL开源的一个 Auth0、Firebase Auth、AWS Cognito 以及为容器和无服务器时代构建的 Keycloak 的现代开源替代方案。 ZITADEL 4.6.0之前版本、3.4.3之前版本和2.71.18之前版本存在授权问题漏洞，该漏洞源于密码重置机制使用可操纵的Forwarded或X-Forwarded-Host标头构造URL，可能导致未授权账户访问。
英文描述:
Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| zitadel | zitadel | >= 4.0.0-rc.1, < 4.6.0 | - | - |
cpe:2.3:a:zitadel:zitadel:>=_4.0.0-rc.1,_<_4.6.0:*:*:*:*:*:*:*
|
| zitadel | zitadel | >= 3.0.0-rc.1, < 3.4.3 | - | - |
cpe:2.3:a:zitadel:zitadel:>=_3.0.0-rc.1,_<_3.4.3:*:*:*:*:*:*:*
|
| zitadel | zitadel | >= 2.0.0, < 2.71.18 | - | - |
cpe:2.3:a:zitadel:zitadel:>=_2.0.0,_<_2.71.18:*:*:*:*:*:*:*
|
| zitadel | zitadel | * | - | - |
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-64101 |
2025-11-11 15:23:34 | 2025-11-11 07:40:49 |
| NVD | nvd_CVE-2025-64101 |
2025-11-11 15:01:07 | 2025-11-11 07:48:36 |
| CNNVD | cnnvd_CNNVD-202510-3960 |
2025-11-11 15:13:00 | 2025-11-11 08:00:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202510-3960
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 3 -> 4
- data_sources: ['cve'] -> ['cve', 'nvd']