CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119127?
CVE-2026-119127 is a high-severity vulnerability in zitadel, published on 29 Oct 2026.
Official description
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
Weakness: CWE-640
Which versions are affected by CVE-2026-119127?
How do I fix CVE-2026-119127?
No fix has been published for CVE-2026-119127 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119127 being exploited?
There is no known exploitation of CVE-2026-119127 in the wild and no public exploit code.
Sources
Also known as GHSA-47m4-8jqx-5r73, GHSA-mchc-246r-6m76.