CVE-2025-67494

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96	Patch
https://github.com/zitadel/zitadel/security/advisories/GHSA-7wfc-4796-gmg5	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ZITADEL es una herramienta de infraestructura de identidad de código abierto. Las versiones 4.7.0 e inferiores son vulnerables a una vulnerabilidad SSRF no autenticada, de lectura completa. La interfaz de usuario de inicio de sesión de ZITADEL (V2) trata el encabezado x-zitadel-forward-host como un respaldo de confianza para todos los despliegues, incluidas las instancias autoalojadas. Esto permite a un atacante no autenticado forzar al servidor a realizar solicitudes HTTP a dominios arbitrarios, como direcciones internas, y leer las respuestas, lo que permite la exfiltración de datos y eludir los controles de segmentación de red. Este problema está solucionado en la versión 4.7.1.

Information

Published : 2025-12-09 22:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-67494

Mitre link : CVE-2025-67494

CVE.ORG link : CVE-2025-67494

JSON object : View

Products Affected

zitadel

zitadel

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-67494", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67494", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T16:13:59.817347Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": "< 1.80.0-v2.20.0.20251208091519-4c879b47334e"}, {"status": "affected", "version": ">= 1.83.4, <= 1.87.5"}, {"status": "affected", "version": ">= 4.0.0-rc.1, < 4.7.1"}]}]}], "published": "2025-12-09T22:16:16.187", "references": [{"url": "https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7wfc-4796-gmg5", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1."}, {"lang": "es", "value": "ZITADEL es una herramienta de infraestructura de identidad de c\u00f3digo abierto. Las versiones 4.7.0 e inferiores son vulnerables a una vulnerabilidad SSRF no autenticada, de lectura completa. La interfaz de usuario de inicio de sesi\u00f3n de ZITADEL (V2) trata el encabezado x-zitadel-forward-host como un respaldo de confianza para todos los despliegues, incluidas las instancias autoalojadas. Esto permite a un atacante no autenticado forzar al servidor a realizar solicitudes HTTP a dominios arbitrarios, como direcciones internas, y leer las respuestas, lo que permite la exfiltraci\u00f3n de datos y eludir los controles de segmentaci\u00f3n de red. Este problema est\u00e1 solucionado en la versi\u00f3n 4.7.1."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1B051D6-969F-4B70-BF3F-AFD77FB00251", "versionEndExcluding": "4.7.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}