Read the docs
TI-2025-41253 Aliases CVE-2025-67494GHSA-7wfc-4796-gmg5

ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

Priority MEDIUM 46CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1github.com/zitadel/zitadel (Go): 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadelbefore 1.80.0-v2.20.0.20251208091519-4c879b47334e; 1.83.4 – 1.87.5; 4.0.0-rc.1 to before 4.7.11.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1Patch availableCNA
—github.com/zitadel/zitadel (Go)before 1.80.0-v2.20.0.20251208091519-4c879b47334e1.80.0-v2.20.0.20251208091519-4c879b47334ePatch availableGHSA-7wfc-4796-gmg5
—github.com/zitadel/zitadel (Go)1.83.4 – 1.87.5—No fix listedGHSA-7wfc-4796-gmg5
—github.com/zitadel/zitadel (Go)4.0.0-rc.1 to before 4.7.14.7.1Patch availableGHSA-7wfc-4796-gmg5
—github.com/zitadel/zitadel/v2 (Go)before 1.80.0-v2.20.0.20251208091519-4c879b47334e1.80.0-v2.20.0.20251208091519-4c879b47334ePatch availableGHSA-7wfc-4796-gmg5
  • zitadel Vendorzitadel Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e; 1.83.4 – 1.87.5; 4.0.0-rc.1 to before 4.7.1 Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1 Patch available CNA
  • github.com/zitadel/zitadel (Go) Vendor— Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Patch available GHSA-7wfc-4796-gmg5
  • github.com/zitadel/zitadel (Go) Vendor— Affected 1.83.4 – 1.87.5 Fixed in — No fix listed GHSA-7wfc-4796-gmg5
  • github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0-rc.1 to before 4.7.1 Fixed in 4.7.1 Patch available GHSA-7wfc-4796-gmg5
  • github.com/zitadel/zitadel/v2 (Go) Vendor— Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Patch available GHSA-7wfc-4796-gmg5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*4.0.0 to before 4.7.1Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.7.1 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
  • Fix · GHSA-7wfc-4796-gmg5 github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Advisory →
  • Fix · GHSA-7wfc-4796-gmg5 github.com/zitadel/zitadel (Go) Fixed in 4.7.1 Advisory →
  • Fix · GHSA-7wfc-4796-gmg5 github.com/zitadel/zitadel/v2 (Go) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67494
  2. 2026-10-03 Alias added: GHSA-7wfc-4796-gmg5

References

Patch 1

Advisory 2

Other 1

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
  • TI-2026-23308 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint CVSS 3.1CRITICAL 9.3
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences