# CVE-2026-119127: ZITADEL Login V2 host header injection in password reset

Source: https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119127 · Severity: high · CVSS 8.1 · Published 2026-10-29

ZITADEL is an open-source identity and access management platform used to authenticate users for applications. An attacker who knows a victim's login name can redirect legitimate password-reset, invite, and email-verification emails to a malicious server, capture the one-time codes, and take over the victim's account—including administrator accounts. The attack requires only that the victim click a link in a genuine email, with no need for the attacker to know the password.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-119127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119127 being exploited in the wild.

**How severe is CVE-2026-119127?** High severity, with a CVSS score of 8.1, published 29 October 2026.

**Which products and versions are affected?** ZITADEL 4.0.0 to 4.19.4.

**Is there a fix for CVE-2026-119127?** Yes: fixed in ZITADEL 4.19.5 and later. Until then: As a partial mitigation on unpatched versions, configure a reverse proxy or load balancer fronting ZITADEL to strip or overwrite the x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host headers on all inbound requests, preventing clients from controlling the public host. However, upgrading to version 4.19.5 or later is the recommended solution. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119127 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119127?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZITADEL 4.19.5 and later

As a partial mitigation on unpatched versions, configure a reverse proxy or load balancer fronting ZITADEL to strip or overwrite the x-zitadel-public-host, x-zitadel-forward-host, and x-forwarded-host headers on all inbound requests, preventing clients from controlling the public host. However, upgrading to version 4.19.5 or later is the recommended solution.

## Technical details

The Login V2 UI constructs password-reset and verification links by trusting client-supplied proxy headers (x-zitadel-public-host, x-zitadel-forward-host, x-forwarded-host) without validating them against the instance's configured trusted domains. An attacker can supply a malicious host header that is not properly validated, especially when the header contains a malformed port that causes the validation to silently fail and fall back to an empty host. Unauthenticated attackers can exploit this to redirect victims to attacker-controlled hosts while the links retain valid single-use codes, enabling account takeover.

## Affected products

- ZITADEL ZITADEL 4.0.0 to 4.19.4

## Timeline

- 2026-10-15: disclosed: GitHub security advisory published
- 2026-10-29: advisory: NVD and VulnCheck advisories published
- 2026-10-15: patched: Fix released in version 4.19.5

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76](https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76)
- [https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection](https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)
- [ZITADEL hosted Login V1 authentication bypass in username change](https://junglewise.ai/threats/cve-2026-109371-zitadel-3-0-0-before-4-18-0-contains-a-missing-authentication)