PT-2026-48543 · Pypi · Litestar
CVE-2026-48061
·
Published
2026-06-10
·
Updated
2026-08-04
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Litestar version 3.0.0b0
Description
AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Because X-Forwarded-Host is client-controllable, an attacker can bypass allowed hosts validation by omitting the Host header and providing an X-Forwarded-Host header set to a whitelisted domain. This occurs in the call function of AllowedHostsMiddleware when the middleware fails to verify if the request passed through a trusted reverse proxy.This bypass can lead to host header injection attacks, including:
- Password reset poisoning: redirecting reset links to an attacker-controlled domain.
- Cache poisoning: polluting cached responses keyed on the host value.
- Routing manipulation: influencing backend selection or routing decisions.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Litestar