Product
ZITADEL versions 4.0.0 before 4.19.5 are vulnerable to host header injection, allowing unauthenticated attackers to redirect sensitive authentication-related emails to attacker-controlled infrastructure.