{"id":"CVE-2026-119127","kind":"vulnerability","aliases":["CVE-2026-119127"],"related":[],"title":"ZITADEL: forged host headers let attackers hijack password-reset links","description":"ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.","summary":"ZITADEL's Login V2 UI builds password-reset, invite and email-verification links from untrusted host headers. An unauthenticated attacker who knows a victim's login name can get genuine emails pointing to their own host, capture the single-use codes, and take over the account, including instance administrators.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","login-v2","package","self-hosted","zitadel"],"not_affected_if":["managed-hosting","version-4.19.5-or-later"],"how_to_check":"- Check the ZITADEL version running in your deployment; the sources say versions 4.0.0 up to but not including `4.19.5` are affected.\n- Check whether your reverse proxy or load balancer passes `x-zitadel-public-host`, `x-zitadel-forward-host` or `x-forwarded-host` headers from clients to ZITADEL.","fix":"- ZITADEL: move to `4.19.5` or later.","status":"open","published_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:29:30+00:00","updated_at":"2026-10-29T16:29:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:30Z","model":"claude-haiku-5-5","output":{"fix":"- ZITADEL: move to `4.19.5` or later.","reach":"internet","title":"ZITADEL: forged host headers let attackers hijack password-reset links","impact":"high","summary":"ZITADEL's Login V2 UI builds password-reset, invite and email-verification links from untrusted host headers. An unauthenticated attacker who knows a victim's login name can get genuine emails pointing to their own host, capture the single-use codes, and take over the account, including instance administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zitadel","self-hosted","identity","login-v2"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attackers take over accounts, including instance administrators","analyst_note":"Confirm whether the Login V2 UI is on by default and whether the victim must open the link, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119127 and the ZITADEL advisory.","how_to_check":"- Check the ZITADEL version running in your deployment; the sources say versions 4.0.0 up to but not including `4.19.5` are affected.\n- Check whether your reverse proxy or load balancer passes `x-zitadel-public-host`, `x-zitadel-forward-host` or `x-forwarded-host` headers from clients to ZITADEL.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-4.19.5-or-later"],"who_is_affected":"Deployments running ZITADEL 4.0.0 through versions before 4.19.5 with the Login V2 UI. The exposure depends on accepting these forwarded host headers from untrusted clients, so any internet-facing login page is the main concern. Teams on managed hosting, or already on 4.19.5 or later, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4203,"output_tokens":675,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119127':14A,17A '-2026':13A,16A '4.0.0':80C '4.19.5':82C 'account':75B,159C 'administr':78B,162C 'allow':95C 'attack':6A,48B,97C,128C 'build':32B 'captur':65B 'code':70B,150C 'contain':83C 'cve':12A,15A 'email':39B,59B,106C,141C 'email-verif':38B,105C 'forg':2A 'forward':120C,125C 'genuin':58B,140C 'get':57B 'harvest':145C 'header':4A,45B,86C,127C 'hijack':7A 'host':3A,25B,44B,64B,85C,116C,121C,126C,144C 'ident':18B 'includ':76B,160C 'inject':87C 'instanc':77B,161C 'invit':36B,103C 'know':50B,129C 'let':5A 'link':11A,41B,108C,138C,153C 'login':20B,29B,54B,91C,133C 'login-v2':19B 'name':55B,134C 'open':155C 'packag':22B 'password':9A,34B,101C 'password-reset':8A,33B,100C 'point':60B,136C 'poison':99C 'public':115C 'reset':10A,35B,102C 'self':24B 'self-host':23B 'singl':68B,148C 'single-us':67B,147C 'suppli':110C 'take':72B,157C 'ui':31B,93C 'unauthent':47B,96C 'untrust':43B,111C 'use':69B,149C 'v2':21B,30B,92C 'verif':40B,107C 'victim':52B,131C 'vulner':88C 'x':113C,118C,124C 'x-forwarded-host':123C 'x-zitadel-forward-host':117C 'x-zitadel-public-host':112C 'zitadel':1A,26B,27B,79C,114C,119C","nicknames":[],"mitigations":[],"who_affected":"Deployments running ZITADEL 4.0.0 through versions before 4.19.5 with the Login V2 UI. The exposure depends on accepting these forwarded host headers from untrusted clients, so any internet-facing login page is the main concern. Teams on managed hosting, or already on 4.19.5 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119127","severity":null,"published_at":"2026-10-29T16:18:05+00:00","modified_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}