CVE-2026-119127 | Zitadel up to 4.19.4 Login V2 UI injection

October 29, 2026 Yanac

A vulnerability classified as critical has been found in Zitadel up to 4.19.4. Affected by this vulnerability is an unknown functionality of the component Login V2 UI. Performing a manipulation of the argument x-zitadel-public-host/x-zitadel-forward-host/x-forwarded-host results in injection.

This vulnerability is reported as CVE-2026-119127. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More