Description
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zitadel | zitadel | < 1.80.0-v2.20.0.20251208091519-4c879b47334e, >= 1.83.4, <= 1.87.5, >= 4.0.0-rc.1, < 4.7.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Chocapikk/CVE-2025-67494 ★ 6 · Dec 10, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/zitadel/zitadel | < 1.80.0-v2.20.0.20251208091519-4c879b47334e | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | >= 1.83.4, <= 1.87.5 | — | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | >= 4.0.0-rc.1, < 4.7.1 | 4.7.1 | GHSA-7wfc-4796-gmg5 |
| Go | github.com/zitadel/zitadel | < 1.80.0-v2.20.0.20251208091519-4c879b47334e · >= 1.83.4 | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GO-2025-4210 |
| Go | github.com/zitadel/zitadel/v2 | < 1.80.0-v2.20.0.20251208091519-4c879b47334e | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-7wfc-4796-gmg5 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026