Live › vulnerability › CVE-2026-119127
ZITADEL's Login V2 UI builds password-reset, invite and email-verification links from untrusted host headers. An unauthenticated attacker who knows a victim's login name can get genuine emails pointing to their own host, capture the single-use codes, and take over the account, including instance administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Deployments running ZITADEL 4.0.0 through versions before 4.19.5 with the Login V2 UI. The exposure depends on accepting these forwarded host headers from untrusted clients, so any internet-facing login page is the main concern. Teams on managed hosting, or already on 4.19.5 or later, can skip it.
No product ranges from the sources yet.
4.19.5 are affected.x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers from clients to ZITADEL.4.19.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-119127")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.