Host Header Injection Vulnerability in ZITADEL by ZITADEL

CVE-2026-119127

What is CVE-2026-119127?

ZITADEL versions prior to 4.19.5 are susceptible to a host header injection vulnerability within the Login V2 UI. This flaw enables unauthenticated attackers to inject untrusted headers (x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host), which can lead to the manipulation of password-reset, invitation, and email verification links. An attacker aware of a victim's username can craft malicious links in seemingly legitimate emails, steering users to their own domains. Upon visiting these links, attackers can capture single-use codes, facilitating account takeovers, including administrative accounts within the ZITADEL instance.

References