CVE-2025-67494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67494
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67494.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67494
Aliases
Published
2025-12-09T22:07:51.878Z
Modified
2026-02-07T02:54:54.745511Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Details

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67494.json"
}
References

Affected packages

Git / github.com/zitadel/zitadel

Affected ranges

Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
2fcab95c5cf833f4b2a3460e8ea560146fbe8b6b
Last affected
d1b845a44cb4f23c5a8d82cf89bee4190c7c5809
Database specific 
{
    "versions": [
        {
            "introduced": "1.83.4"
        },
        {
            "last_affected": "1.87.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
8f0b7ebf028187e84881694bb931cbe33604e308
Fixed
38c7ce7e5250f433403abe9a9de9a8f47f5f39e3
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0-rc.1"
        },
        {
            "fixed": "4.7.1"
        }
    ]
}

Affected versions

v1.*
v1.83.4
v1.83.5
v1.83.6
v1.83.7
v1.84.0
v1.84.1
v1.84.2
v1.84.3
v1.84.4
v1.84.5
v1.85.0
v1.86.0
v1.87.0
v1.87.1
v1.87.2
v1.87.3
v1.87.4
v1.87.5
v3.*
v3.3.1
v3.3.2
v4.*
v4.0.0
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.0-rc.4
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v4.6.6
v4.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67494.json"