CVE-2026-119127: ZITADEL Login V2 host header injection in password reset

CVE-2026-119127 · Severity: high · CVSS 8.1 · Published 2026-10-29

ZITADEL is an open-source identity and access management platform used to authenticate users for applications. An attacker who knows a victim's login name can redirect legitimate password-reset, invite, and email-verification emails to a malicious server, capture the one-time codes, and take over the victim's account—including administrator accounts. The attack requires only that the victim click a link in a genuine email, with no need for the attacker to know the password.

Technologies: ZITADEL. Vendors: ZITADEL.

Quick answers

Is CVE-2026-119127 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-119127 being exploited in the wild.
How severe is CVE-2026-119127?
High severity, with a CVSS score of 8.1, published 29 October 2026.
Which products and versions are affected?
ZITADEL 4.0.0 to 4.19.4.
Is there a fix for CVE-2026-119127?
Yes: fixed in ZITADEL 4.19.5 and later. Until then: As a partial mitigation on unpatched versions, configure a reverse proxy or load balancer fronting ZITADEL to strip or overwrite the x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host headers on all inbound requests, preventing clients from controlling the public host. However, upgrading to version 4.19.5 or later is the recommended solution. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119127 attacked?
It is attacked over the network.
Am I affected by CVE-2026-119127?
Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: ZITADEL 4.19.5 and later

As a partial mitigation on unpatched versions, configure a reverse proxy or load balancer fronting ZITADEL to strip or overwrite the x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host headers on all inbound requests, preventing clients from controlling the public host. However, upgrading to version 4.19.5 or later is the recommended solution.

Technical details

The Login V2 UI constructs password-reset and verification links by trusting client-supplied proxy headers (x-zitadel-public-host, x-zitadel-forward-host, x-forwarded-host) without validating them against the instance's configured trusted domains. An attacker can supply a malicious host header that is not properly validated, especially when the header contains a malformed port that causes the validation to silently fail and fall back to an empty host. Unauthenticated attackers can exploit this to redirect victims to attacker-controlled hosts while the links retain valid single-use codes, enabling account takeover.

Affected products

  • ZITADEL ZITADEL 4.0.0 to 4.19.4

Timeline

  • 2026-10-15: disclosed: GitHub security advisory published
  • 2026-10-29: advisory: NVD and VulnCheck advisories published
  • 2026-10-15: patched: Fix released in version 4.19.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.