CVE-2026-48061: Litestar Auth Bypass Vulnerability

CVE-2026-48061 Overview

CVE-2026-48061 is a host header injection vulnerability in Litestar, an Asynchronous Server Gateway Interface (ASGI) framework for Python. In versions prior to 2.22.0, the AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Attackers can bypass allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The weakness is classified as [CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax]. The issue was fixed in Litestar version 2.22.0.

Critical Impact
Successful exploitation enables password reset poisoning, web cache poisoning, and server-side request routing manipulation against applications using AllowedHostsConfig.

Affected Products

Litestar ASGI framework versions prior to 2.22.0
Applications using AllowedHostsConfig deployed without a reverse proxy that strips X-Forwarded-Host
Applications accepting HTTP/1.0 connections where the Host header is optional

Discovery Timeline

2026-08-03 - CVE-2026-48061 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-48061

Vulnerability Analysis

Litestar's AllowedHostsMiddleware enforces host validation to prevent host header injection. The middleware inspects the incoming Host header and compares it against a configured allowlist. When the Host header is missing, the middleware falls back to the X-Forwarded-Host header to determine the request host.

The X-Forwarded-Host header is client-controllable in deployments that do not sit behind a reverse proxy configured to strip or overwrite it. Attackers can therefore submit a request that omits Host and sets X-Forwarded-Host to any allowed domain, defeating the allowlist check. HTTP/1.0 makes the attack straightforward because the Host header is not mandatory in that protocol version.

Once the middleware trusts the injected host value, downstream application logic that consumes the host string inherits the attacker-controlled value. This enables password reset link poisoning, cache key manipulation, and server-side redirection to attacker-controlled destinations.

Root Cause

The root cause is misplaced trust in a client-supplied header. AllowedHostsMiddleware treats X-Forwarded-Host as authoritative without verifying that the request originated from a trusted proxy. A proxy-aware middleware must either require the Host header outright or accept X-Forwarded-Host only when the immediate peer is a trusted upstream.

Attack Vector

The attack is delivered over the network without authentication or user interaction. An attacker sends a crafted HTTP request that omits the Host header and injects X-Forwarded-Host: allowed.example.com. The Litestar application processes the request as if it originated for the whitelisted host, and any downstream feature that emits URLs based on the request host will embed the attacker-controlled value. See the GitHub Security Advisory GHSA-3qmc-cj7q-62hv for the full technical write-up.

Detection Methods for CVE-2026-48061

Indicators of Compromise

Inbound HTTP requests that lack a Host header but include an X-Forwarded-Host header when no legitimate upstream proxy is present
HTTP/1.0 requests reaching the Litestar application directly from untrusted networks
Password reset or account verification emails containing URLs pointing to unexpected external domains

Detection Strategies

Log the raw Host and X-Forwarded-Host headers at the application or proxy tier and alert on requests where Host is empty while X-Forwarded-Host is populated
Correlate outbound password reset links or webhook callbacks against the domain allowlist to identify poisoned URLs
Inspect cache keys generated by intermediate caches for unexpected host values that could indicate cache poisoning

Monitoring Recommendations

Enable request-header logging at the reverse proxy and centralize logs for anomaly analysis
Track version telemetry for Python dependencies and flag hosts running Litestar < 2.22.0
Monitor authentication workflows (password reset, email verification) for abnormal link generation patterns

How to Mitigate CVE-2026-48061

Immediate Actions Required

Upgrade Litestar to version 2.22.0 or later, which removes the X-Forwarded-Host fallback in AllowedHostsMiddleware
Deploy a reverse proxy in front of the Litestar application that unconditionally strips or overwrites the X-Forwarded-Host header from untrusted clients
Disable HTTP/1.0 support or require the Host header at the proxy tier before requests reach the application

Patch Information

The fix is delivered in Litestar 2.22.0. The upstream change is available in the Litestar patch commit 6930a20. Review the GitHub Security Advisory GHSA-3qmc-cj7q-62hv for advisory metadata and affected version ranges.

Workarounds

Configure the fronting reverse proxy (for example, Nginx, HAProxy, or Envoy) to remove X-Forwarded-Host from all inbound requests and to reject requests missing a Host header
Restrict application ingress to HTTP/1.1 or HTTP/2 so the Host header is required by protocol
If patching is delayed, implement a custom ASGI middleware that rejects requests where the Host header is absent

bash

# Nginx example: strip client-supplied X-Forwarded-Host and enforce Host header
server {
    listen 443 ssl http2;
    server_name app.example.com;

    if ($http_host = "") {
        return 400;
    }

    location / {
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_pass http://litestar_upstream;
    }
}