CVE-2026-119127 in Zitadel
Summary
by MITRE • 10/29/2026
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in ZITADEL versions prior to 4.19.5 represents a critical authentication bypass mechanism rooted in improper validation of HTTP Host headers within the Login V2 user interface. This flaw allows unauthenticated remote attackers to manipulate the origin and destination contexts of sensitive identity management operations, specifically password resets, account invitations, and email verification processes. The core technical deficiency lies in the application's reliance on client-supplied header values rather than server-side configuration or trusted internal routing mechanisms when constructing URLs for these critical security flows. By injecting malicious host names through specific HTTP headers such as x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host, an attacker can force the system to generate links that point back to a domain under their control instead of the legitimate ZITADEL instance. This behavior violates fundamental security principles regarding trust boundaries in web applications, where user input must never be directly used to determine critical routing or redirection logic without rigorous sanitization and validation against a whitelist of allowed hosts.
From an operational perspective, this vulnerability enables account takeover attacks that can escalate to full administrative compromise depending on the victim's privileges within the ZITADEL instance. The attack vector requires minimal prerequisites; specifically, the attacker only needs knowledge of the target user's login name or email address. Once identified, the attacker initiates a password reset, invitation, or verification request through the standard interface but manipulates the underlying HTTP headers during transmission. When the victim receives the legitimate-looking notification email containing the single-use code link, they are unaware that the destination domain has been altered to an attacker-controlled server. Upon clicking the link and entering their credentials or confirmation codes, these sensitive authentication tokens are harvested by the malicious host rather than being processed securely by ZITADEL. This allows the attacker to reset passwords for standard users or potentially escalate privileges if administrative accounts are targeted, leading to unauthorized access, data exfiltration, and potential lateral movement within connected systems that trust this identity provider.
This vulnerability aligns with CWE-113, Improper Neutralization of CRLF Sequences in HTTP Headers, although it specifically manifests as a Host Header Injection which is often categorized under CWE-642, External Control of Critical State Data, or more broadly under injection flaws where untrusted data influences control flow. In the context of the MITRE ATT&CK framework, this technique corresponds to T1078, Valid Accounts, and specifically supports techniques related to Account Manipulation such as T1098.004, SSH Authorized Key Modification, or more accurately in web contexts, Credential Access via Phishing (T1566) combined with Session Hijacking principles if the single-use codes are intercepted. The exploitation of this flaw effectively bypasses multi-factor authentication protections because the attacker intercepts the second factor token before it can be validated by the legitimate service provider.
Mitigation strategies must prioritize immediate patching to version 4.19.5 or later, where these header injection vectors have been addressed through stricter input validation and default-to-configuration behaviors that ignore untrusted host headers for sensitive operations. In environments where upgrading is not immediately feasible, network-level controls such as web application firewalls can be configured to block requests containing suspicious values in the x-zitadel-public-host or similar custom headers if they do not match expected domain patterns. Additionally, implementing strict Content Security Policy directives and ensuring that email templates are generated server-side using absolute URLs derived from secure configuration sources rather than dynamic header inputs will reduce the risk surface. Organizations should also monitor for unusual spikes in password reset requests originating from specific IP ranges or associated with known malicious domains to detect potential exploitation attempts in real-time.