GHSA-mchc-246r-6m76: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

Published Oct 29, 2026

Updated

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.

Frequently Asked Questions

Who can exploit this vulnerability, and what information do they need?

An unauthenticated remote attacker can exploit it if they know a victim's login name. Exploitation also requires the victim to open a password-reset, invite, or email-verification link sent in a genuine email.

Which account flows are exposed?

Password-reset, invitation, and email-verification links generated by the Login V2 UI can be poisoned through untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. The resulting links can direct victims to an attacker-controlled host that captures the single-use codes.

What is the impact if exploitation succeeds?

An attacker can use captured single-use codes to take over the victim's account. This can include instance administrator accounts.

Which versions are affected?

ZITADEL versions starting with 4.0.0 and before 4.19.5 are affected.

GHSA-mchc-246r-6m76: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

Frequently Asked Questions

Who can exploit this vulnerability, and what information do they need?

Which account flows are exposed?

What is the impact if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability, and what information do they need?

Which account flows are exposed?

What is the impact if exploitation succeeds?

Which versions are affected?