Wim07101993

The Login V2 UI is susceptible to host header injection. Unauthenticated attackers can poison password-reset, invite, and email-verification links by providing untrusted values in the `x-zitadel-public-host`, `x-zitadel-forward-host`, or `x-forwarded-host` headers. If an attacker knows a victim's login name, they can redirect links in legitimate emails to a host under their control to harvest single-use codes and take over accounts, including those of instance administrators.

Authenticated users can tamper with their own IdP intent tokens due to the use of unauthenticated, malleable encryption. This allows a user to modify a token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can use the '/v2/idp intents' or '/v2/sessions' endpoints to steal IdP tokens or hijack a session.