CVE-2026-119127: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need authentication, but must know a victim's login name. They must be able to submit requests with a malicious x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host header and induce the victim to open a genuine password-reset, invitation, or email-verification link.
Which accounts are at risk?
Any account for which an attacker can trigger a relevant email flow and knows the login name may be exposed. The issue can lead to takeover of accounts including instance administrators.
How does the attacker obtain the account takeover material?
The injected host header causes links in legitimate ZITADEL emails to point to an attacker-controlled host. When the recipient opens the link, the attacker can harvest its single-use code and use it to take over the account.
What should be prioritized if immediate patching is not possible?
Prevent untrusted client requests from supplying or controlling x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host headers. This should be enforced at the reverse proxy or other trusted ingress layer so externally supplied values cannot influence generated email links.