ZITADEL (< 4.19.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zitadel--4.19.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:33:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZITADEL: Login V2 UI host header injection (CVE-2026-119127)https://feed.craftedsignal.io/briefs/2026-10-zitadel-host-header-injection/Thu, 29 Oct 2026 17:33:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zitadel-host-header-injection/ZITADEL versions 4.0.0 before 4.19.5 are vulnerable to host header injection, allowing unauthenticated attackers to redirect sensitive authentication-related emails to attacker-controlled infrastructure.ZITADEL versions 4.0.0 through 4.19.4 are vulnerable to host header injection within the Login V2 UI. An unauthenticated attacker can manipulate the host of generated URLs in password-reset, invite, and email-verification messages by injecting specific headers, including x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host. By successfully influencing these links, an attacker can capture single-use authentication tokens when victims click them, facilitating account takeover for users and instance administrators.

Impact

Successful exploitation allows unauthenticated attackers to perform account takeovers, including high-privileged administrator accounts, by intercepting and harvesting sensitive authentication tokens sent via email.

Recommendation

  • Upgrade ZITADEL instances to version 4.19.5 or later immediately.
  • Audit logs for web requests containing unexpected or anomalous X-Forwarded-Host or X-Zitadel-prefixed headers targeting the Login V2 UI.
  • Review administrative access logs for suspicious modifications or account lifecycle events during the vulnerability window.
]]>highadvisoryweb-application-vulnerabilityhost-header-injectioncve-2026-119127