Executive brief
Litestar is a Python web framework used for building APIs and applications. A security flaw in its host validation middleware allows attackers to bypass domain restrictions by using a specific web header. This could allow an attacker to trick the system into sending password reset links to a malicious site or corrupting the application's cache, potentially leading to account takeovers or service disruptions.
Technical details
The AllowedHostsMiddleware in Litestar incorrectly trusts the client-controlled X-Forwarded-Host header as a fallback when the standard Host header is missing. An attacker can exploit this by sending a request without a Host header and setting X-Forwarded-Host to a whitelisted domain, bypassing the regex-based host validation. This vulnerability is particularly effective in environments without a reverse proxy that strips untrusted forwarding headers. Successful exploitation enables host header injection attacks, including password reset poisoning, cache poisoning, and routing manipulation. The issue is fixed in version 2.22.0.
Affected products
- litestar-org litestar < 2.22.0
Timeline
- 2026-05-20: disclosed: Vulnerability reported to maintainers
- 2026-06-10: advisory: GitHub Advisory published
- 2026-06-10: patched: Fix released in version 2.22.0