id: GO-2025-3721
modules:
    - module: github.com/zitadel/zitadel
      versions:
        - fixed: 0.0.0-20250528081227-c097887bc5f6
      non_go_versions:
        - introduced: 2.38.3
        - fixed: 2.70.12
        - introduced: 2.71.0
        - fixed: 2.71.11
        - introduced: 3.0.0-rc1
        - fixed: 3.2.2
summary: ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel
ghsas:
    - GHSA-93m4-mfpg-c3xf
references:
    - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-93m4-mfpg-c3xf
    - fix: https://github.com/zitadel/zitadel/commit/c097887bc5f680e12c998580fb56d98a15758f53
notes:
    - fix: 'github.com/zitadel/zitadel: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-93m4-mfpg-c3xf
    created: 2025-05-29T12:52:59.445805-04:00
review_status: UNREVIEWED