Detections
Analytics

SCA: security update for github.com/zitadel/zitadel/v2 (GHSA-mwmh-7px9-4c23)

high Tenable Self-Hosted Container Security Plugin ID 435876

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential
 vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-
 Host header from incoming requests to construct the URL for the password reset confirmation link. This
 link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers
 (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to
 a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the
 secret reset code embedded in the URL can be captured by the attacker. This captured code could then be
 used to reset the user's password and gain unauthorized access to their account. It's important to note
 that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or
 Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.
 (CVE-2025-64101)

See Also

https://github.com/advisories/GHSA-mwmh-7px9-4c23

Plugin Details

Severity: High

ID: 435876

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 10/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.75

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-64101

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2025

Vulnerability Publication Date: 10/29/2025

Reference Information

CVE: CVE-2025-64101