CVE-2025-67494Critical· 9.3▾ AbyssalPoC availableZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo (last check)
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
zitadel >= 4.0.0, < 4.7.1Upgrade past the affected range:
zitadel 4.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67495High· 8.0ZITADEL is an open-source identity infrastructure tool
CVE-2026-105214Low· 2.3Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2025-67717Medium· 4.3ZITADEL is an open-source identity infrastructure tool
CVE-2026-109373High· 8.1ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies
CVE-2026-109374Medium· 5.5ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check