ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-64101 · Microsoft / collected KEV context

EUVD-2025-36698

GHSA-mwmh-7px9-4c23

GO-2025-4084

cve-program · CVE-2025-64101

• https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23
• https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1

euvd · EUVD-2025-36698

• https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23
• https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1

nvd · CVE-2025-64101

• https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1
• https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23

osv · GHSA-mwmh-7px9-4c23

• https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23
• https://nvd.nist.gov/vuln/detail/CVE-2025-64101
• https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1
• https://github.com/zitadel/zitadel
• https://pkg.go.dev/vuln/GO-2025-4084

osv · GO-2025-4084

• https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23
• https://nvd.nist.gov/vuln/detail/CVE-2025-64101
• https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1

No related operational record is retained in the current change model.