Vulnerability Summary

• Vulnerability Name: ZITADEL Unauthenticated Full-Read SSRF
• CVE ID: CVE-2025-67494
• CVSS Score: 9.3
• Severity: Critical
• Vulnerability Type: Server-Side Request Forgery (SSRF)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Exploitability: High (unauthenticated, remote)
• Affected Component: ZITADEL V2 Login UI
• Patch Available: Yes

Overview

ZITADEL has fixed a critical security issue that allowed unauthenticated attackers to abuse the platform as a request proxy and read responses from internal or external services. The vulnerability, tracked as CVE-2025-67494, affects ZITADEL versions 4.7.0 and earlier and applies to both cloud-hosted and self-hosted deployments.

At its core, this issue allowed attackers to influence how ZITADEL determines trusted service URLs during login flows. Because the flaw could be triggered without logging in or interacting with a user, it presents a serious risk in exposed environments.

What Caused the Vulnerability

The issue stems from how the V2 Login UI handled forwarded host headers, specifically the x-zitadel-forward-host header.

ZITADEL treated this header as a trusted fallback value across all deployments. While this behavior may be valid in tightly controlled environments, it became dangerous when applied universally without strict validation. As a result, ZITADEL accepted attacker-supplied host values and used them to construct outbound requests.

Because those requests were made from the server itself, attackers could reach internal services that are normally inaccessible from the internet.

How the Vulnerability Can Be Exploited

An attacker can exploit this issue by sending a crafted request to the ZITADEL login endpoint and injecting a malicious value into the x-zitadel-forward-host header.

Once processed, ZITADEL will:

1. Trust the supplied host value
2. Initiate an outbound HTTP request to the attacker-controlled destination
3. Return the full response to the attacker

This enables full-read SSRF, meaning the attacker can not only trigger requests but also view the response content. The attack does not require authentication, special privileges, or user interaction, making it easy to exploit remotely.

Impact and Risk

If exploited, CVE-2025-67494 allows attackers to:

• Access internal services protected by network boundaries
• Bypass IP-based access restrictions
• Retrieve sensitive configuration or API data
• Query cloud metadata services and extract credentials
• Perform internal network discovery and pivoting

The changed scope rating reflects the fact that the impact extends beyond ZITADEL itself. Once exploited, the vulnerability can expose entirely separate systems that trust ZITADEL’s network position.

From a security standpoint, the risk is primarily confidentiality-focused, but the reconnaissance capabilities it enables can also support more complex follow-on attacks.

Affected Versions

• ZITADEL versions 4.7.0 and below
• Affected component: V2 Login UI
• Deployment types:
  • Cloud-hosted
  • Self-hosted

Any publicly reachable instance running a vulnerable version should be considered exposed.

Official Patch Information

ZITADEL has released version 4.7.1, which resolves CVE-2025-67494.

What the Patch Changes

The fixed version introduces proper validation for:

• X-Forwarded-Host
• Forwarded

These headers are now checked against explicitly trusted and configured instance domains. Untrusted or unexpected host values are no longer accepted, preventing attackers from steering outbound requests.

Recommended Fix

• Upgrade to ZITADEL 4.7.1 or later

This is the only complete and permanent fix.

Official References

• ZITADEL Releases (official):
  https://github.com/zitadel/zitadel/releases
• ZITADEL v4.7.1 Release (Patch):
  https://github.com/zitadel/zitadel/releases/tag/v4.7.1

These pages provide the authoritative source for the patched version and release notes.

How to Apply the Patch (Self-Hosted Deployments)

The exact upgrade steps depend on how ZITADEL is deployed, but the general process is:

1. Review the v4.7.1 release notes for compatibility considerations
2. Update the ZITADEL image or binary to version 4.7.1
3. Redeploy the service using your existing configuration
4. Verify that the application is running the updated version
5. Confirm login flows function as expected

For containerized deployments, this typically involves updating the image tag and redeploying.

Temporary Mitigation (If You Cannot Upgrade Immediately)

If an immediate upgrade is not possible, a proxy-level mitigation can reduce exposure.

Proxy Configuration Workaround

If ZITADEL is deployed behind a reverse proxy:

• Strip all forwarded host headers before requests reach ZITADEL
  or
• Override forwarded headers so they always reflect the original request host

This prevents attackers from injecting arbitrary values into x-zitadel-forward-host.

Important Note

This mitigation only reduces risk. It does not eliminate the vulnerability and should be treated as a short-term measure until the official patch is applied.

Additional Hardening Recommendations

After patching, organizations should consider:

• Reviewing which headers are trusted by upstream services
• Limiting outbound network access from identity infrastructure
• Monitoring for unexpected internal request patterns
• Restricting access to sensitive metadata endpoints

These steps help reduce the impact of similar issues in the future.

Final Takeaway

CVE-2025-67494 is a high-impact SSRF vulnerability with minimal exploitation barriers. Because it allows unauthenticated attackers to read responses from internal services, it presents a serious risk to identity infrastructure and connected systems.

Organizations running ZITADEL should upgrade to version 4.7.1 immediately, apply proxy-level mitigations where needed, and review network trust boundaries to ensure forwarded headers are handled safely.