ZITADEL: Login V2 UI host header injection (CVE-2026-119127)

ZITADEL versions 4.0.0 through 4.19.4 are vulnerable to host header injection within the Login V2 UI. An unauthenticated attacker can manipulate the host of generated URLs in password-reset, invite, and email-verification messages by injecting specific headers, including x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host. By successfully influencing these links, an attacker can capture single-use authentication tokens when victims click them, facilitating account takeover for users and instance administrators.

Impact

Successful exploitation allows unauthenticated attackers to perform account takeovers, including high-privileged administrator accounts, by intercepting and harvesting sensitive authentication tokens sent via email.

Recommendation

• Upgrade ZITADEL instances to version 4.19.5 or later immediately.
• Audit logs for web requests containing unexpected or anomalous X-Forwarded-Host or X-Zitadel-prefixed headers targeting the Login V2 UI.
• Review administrative access logs for suspicious modifications or account lifecycle events during the vulnerability window.