UpHeron
All vulnerabilities

Servers and applications

CVE-2025-67494

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains,…

Severity
High 8.6
Published
9 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.7.1
Sources
NVD

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 4.0.0 before 4.7.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-67494
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67494