CVE-2026-48061

MediumCVSS 5.9

Published: 03/08/2026(UTC)Updated: 04/08/2026(UTC)Translated: 04/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Litestar prior to version 2.22.0 contains a vulnerability in AllowedHostsMiddleware that allows an attacker to bypass allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. Since X-Forwarded-Host is client-controllable, this enables host header injection attacks.

Risk Assessment

An attacker can exploit this vulnerability for cache poisoning, password reset poisoning, or server-side request routing manipulation, potentially leading to account takeover or data leakage.

Recommendation

Upgrade Litestar to version 2.22.0 or later, which fixes this vulnerability, or configure a reverse proxy to strip the X-Forwarded-Host header.

Other vulnerabilities in Litestar

CVE-2026-48060High
Litestar, an ASGI framework, prior to version 2.20.0 is vulnerable to HTML Injection which can be escalated to Cross Site Scripting (XSS) when a template engine is used with CSRF protection and the CSRF cookie contents are not automatically escaped by the template engine if configured per documentation recommendations.

Original NVD description (English source)

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0.