CVE-2026-119127

The record

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.

Affected packages

Related vulnerabilities

• CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. CWE-640
• CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-640
• CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
• CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
• CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. CWE-640
• CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes… CWE-640
• CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges… CWE-640
• CVE-2026-82487 A vulnerability was determined in Beetel 450TC3 01.00.00_01. CWE-640