TI-2025-11390 Aliases CVE-2025-12414 GHSA-5vh2-6vmq-fw7j

Looker account compromise via punycode homograph attack

MEDIUM 42CWE-290Published 2025-11-20 · Updated 2025-11-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.193+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+ * 25.12.0+

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00375 31st percentileScored 2026-11-07

Fix Fixed Looker (Google Cloud): 24.12.100, 24.18.193, 25.0.69 +4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Google	Looker	before 24.12.100; before 24.18.193; before 25.0.69; before 25.6.57; before 25.8.39; before 25.10.22; before 25.12.0	24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0	Patch available	CNA
Google	Looker	before 24.12.100; before 24.18.193; before 25.0.69; before 25.6.57; before 25.8.39; before 25.10.22; before 25.12.0	24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0	Patch available	CNA

Looker VendorGoogle Affected before 24.12.100; before 24.18.193; before 25.0.69; before 25.6.57; before 25.8.39; before 25.10.22; before 25.12.0 Fixed in 24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0 Patch available CNA
Looker VendorGoogle Affected before 24.12.100; before 24.18.193; before 25.0.69; before 25.6.57; before 25.8.39; before 25.10.22; before 25.12.0 Fixed in 24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0 Patch available CNA

Remediation

Fix · CNA Looker (Google Cloud) Fixed in 24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0
Fix · CNA Looker (Google Cloud) Fixed in 24.12.100, 24.18.193, 25.0.69, 25.6.57, 25.8.39, 25.10.22, 25.12.0

Timeline

2026-10-02 Threatist record created from CVE-2025-12414
2026-10-03 Alias added: GHSA-5vh2-6vmq-fw7j

References

Other 1

https://cloud.google.com/support/bulletins#GCP-2025-067

TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6

See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences