Zitadel 4.0.0 Before 4.19.5 Account Takeover Via Login V2 Host Header Injection

Back www.vulncheck.com

Zitadel 4.0.0 Before 4.19.5 Account Takeover Via Login V2 Host Header Injection

www.vulncheck.com • October 30, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ZITADEL Vulnerabilities CVE-2026-119127 and CVE-2026-119128 Expose Accounts to Takeover ZITADEL versions 4.0.0 to 4.19.5 have two vulnerabilities: CVE-2026-119127 allows unauthenticated attackers to exploit host header injection, while CVE-2026-119128 enables authentication bypass for accounts without an authentication method. Both vulnerabilities were published on 2026-10-29, with CVE-2026-119128 rated as CVSS 9.1 () and CVE-2026-119127 rated as CVSS 8.6 (High). Attackers can take over accounts by manipulating recovery links or setting initial credentials. Organizations using ZITADEL for identity management, especially those with administrator accounts, are at risk. No active exploitation has been confirmed yet, but urgent patching is recommended. The vendor has released updates to address these vulnerabilities. 2 sources 71

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

T1078 - Valid Accounts T1190 - Exploit Public-Facing Application

Vulnerabilities (1)

Host Header Injection