tocsin

CVE-2025-48936

3 advisories.

Go/github.com/zitadel/zitadel CVE-2025-48936: high 8.1, EPSS 0.39%

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

Action: Upgrade github.com/zitadel/zitadel to 0.0.0-20250528081227-c097887bc5f6 or later.

go get github.com/zitadel/zitadel@v0.0.0-20250528081227-c097887bc5f6

Affected

introducedfixedlast affected
0--

Fixed versions

0.0.0-20250528081227-c097887bc5f6

Sources

CVE-2025-48936 · published · modified · JSON

Go/github.com/zitadel/zitadel/v2 CVE-2025-48936: high 8.1, EPSS 0.39%

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

Action: Upgrade github.com/zitadel/zitadel/v2 to 2.70.12 or later.

go get github.com/zitadel/zitadel/v2@v2.70.12
go get github.com/zitadel/zitadel/v2@v3.2.2
go get github.com/zitadel/zitadel/v2@v2.71.11

Affected

introducedfixedlast affected
2.38.32.70.12-
3.0.0-rc13.2.2-
2.71.02.71.11-
0--

Fixed versions

2.70.123.2.22.71.11

Sources

CVE-2025-48936 · published · modified · JSON

Go/github.com/zitadel/zitadel CVE-2025-48936: unknown, EPSS 0.39%

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 0.0.0-20250528081227-c097887bc5f6 or later.

go get github.com/zitadel/zitadel@v0.0.0-20250528081227-c097887bc5f6

Affected

introducedfixedlast affected
0--

Fixed versions

0.0.0-20250528081227-c097887bc5f6

Sources

CVE-2025-48936 · published · modified · JSON