CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Unauthenticated attackers can force the server to make arbitrary HTTP requests and read responses, enabling data exfiltration and network segmentation bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67494?
CVE-2025-67494 is a critical server-side request forgery vulnerability in zitadel, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
Weakness: CWE-918
Which versions are affected by CVE-2025-67494?
9 open source packages ship an affected version, including github.com/zitadel/zitadel and github.com/zitadel/zitadel/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
github.com/zitadel/zitadel Go | From 1.83.4 to 1.87.5 | None |
github.com/zitadel/zitadel Go | From 1.83.4 to 1.87.5 | None |
github.com/zitadel/zitadel Go | From 4.0.0-rc.1 | 4.7.1 |
3 more packages
github.com/zitadel/zitadel Go | From 4.0.0-rc.1 | 4.7.1 |
github.com/zitadel/zitadel/v2 Go | All versions | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
github.com/zitadel/zitadel/v2 Go | All versions | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
Products include Zitadel Zitadel.
How do I fix CVE-2025-67494?
Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 1.80.0-v2.20.0.20251208091519-4c879b47334e or 4.7.1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-67494 being exploited?
There is no known exploitation of CVE-2025-67494 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
- CVE-2024-29891 ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
Sources
Also known as GHSA-7wfc-4796-gmg5, GO-2025-4210.