Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M
CVE-2025-67494ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Critical 9.3
In plain English
A critical-severity server-side request forgery in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | no fix listed | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | 4.7.1 | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GO-2025-4210 |
| Go | github.com/zitadel/zitadel/v2 | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-7wfc-4796-gmg5 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N