CVE Alert: CVE-2026-119127 – zitadel

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim’s login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.

**Risk verdict:** This is a high-consequence account-takeover risk; urgency cannot be elevated to priority 1 without KEV or EPSS data confirming that threshold.

**Why this matters:** Successful abuse could expose sensitive account data and let an attacker act as the victim, including a privileged administrator. That creates realistic risks of unauthorised configuration changes, access to connected services, and loss of trust in account-recovery emails. KEV, SSVC, PoC and EPSS indicators were not supplied, so active exploitation and exploit maturity remain uncertain.

**Most likely attack path:** An unauthenticated remote attacker can make a low-complexity request without special access, then rely on a victim opening a legitimate recovery or verification email. The victim’s action can disclose a single-use credential; the stated scope is unchanged, so impact is centred on the affected account rather than direct cross-system compromise.

**Who is most exposed:** Organisations using this identity service for customer or workforce sign-in are exposed, especially where it manages administrator accounts and email-based recovery.

Review proxy logs for unusual host-related forwarding headers on login and recovery routes.

Alert on recovery or verification emails with unexpected destination hosts or domains.

Investigate rapid recovery requests followed by new sessions, credential changes, or privileged actions.

Mitigation and prioritisation

Upgrade promptly to the vendor’s fixed release; verify all instances and deployments are covered.

Until patched, reject or overwrite untrusted host-forwarding headers at trusted proxies.

Review recent recovery events and privileged account activity; invalidate suspicious sessions and credentials.

Confirm KEV and EPSS status before assigning emergency priority; coordinate patching with identity-service change controls.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.