---
id: CVE-2026-119127
title: >-
  ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header
  Injection
summary: >-
  ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in
  the Login V2 UI that allows unauthenticated attackers to poison
  password-reset, invite, and email-verification links by supplying untrusted
  x-zitadel-public-ho…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-640
vendor: zitadel
product: zitadel
affected:
  - zitadel >= 4.0.0 < 4.19.5
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T15:58:09.747Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119127'
references:
  - url: 'https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76'
    label: GitHub Security Advisory (GHSA-mchc-246r-6m76)
  - url: >-
      https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection
    label: >-
      VulnCheck Advisory: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login
      V2 Host Header Injection
tags:
  - cve.org
epss: 0.00278
epssPercentile: 0.20263
ingestedAt: '2026-11-01T21:01:32.724Z'
---

## Overview

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.

## Affected

- `zitadel >= 4.0.0 < 4.19.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.