Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-119127 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection	[email protected]	AdvisoryVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-640	Weak Password Recovery Mechanism for Forgotten Password	[email protected]

Affected Products

Product	Versions
ZITADEL	>= 4.0.0, < 4.19.5 (semver)
CPE cpe:2.3:a:zitadel:zitadel:::::::: Remediation Upgrade: >= 4.19.5moderate efforthttps://github.com/zitadel/zitadel/releases/tag/v4.19.5 Mitigation:low effort Configure a ZITADEL fronting proxy to strip or overwrite the `x-zitadel-public-host`, `x-zitadel-forward-host`, and `x-forwarded-host` headers on all inbound requests.

Change History

2 change records found show changes

Date	Action	Recorded By
Nov 4, 2026	CVE Modified	CISA-ADP
Oct 29, 2026	New CVE Received	[email protected]