CVE-2026-119127

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.19.4

Description The Login V2 UI is susceptible to host header injection. Unauthenticated attackers can poison password-reset, invite, and email-verification links by providing untrusted values in the x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. If an attacker knows a victim's login name, they can redirect links in legitimate emails to a host under their control to harvest single-use codes and take over accounts, including those of instance administrators.

Recommendations Update ZITADEL to version 4.19.5 or later.