ZITADEL anfällig für Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel

The SSRF vulnerability in Zitadel allows an attacker to craft malicious requests that originate from the Zitadel server itself. This enables them to bypass access controls and read data from internal services or external resources that Zitadel would normally not be able to access. Successful exploitation could lead to the exposure of sensitive configuration data, API keys, or even internal database contents. The 'full-read' nature of the vulnerability significantly expands the potential attack surface, as the attacker is not limited to specific endpoints or data types. This could be leveraged for reconnaissance, data exfiltration, or even as a stepping stone for further attacks within the internal network.

Organizations utilizing Zitadel as their authentication server, particularly those with exposed instances or those running older versions (prior to 4.7.1), are at significant risk. Shared hosting environments where multiple users share a single Zitadel instance are also particularly vulnerable, as a compromise of one user's account could potentially lead to the compromise of the entire instance.

• linux / server:

journalctl -u zitadel -f | grep -i "Server-Side Request Forgery"

• generic web:

curl -I <zitadel_url>/internal_endpoint  # Check for unexpected responses

• generic web:

 grep -r "internal_url" /etc/zitadel/config.yml # Check for exposed internal URLs in config

1. 2025-12-15Disclosure

   disclosure

1. Reserviert2025-12-08
2. Veröffentlicht2025-12-15
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-67494 is to immediately upgrade Zitadel to version 1.80.0-v2.20.0.20251208091519-4c879b47334e or a later patched version. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access from the Zitadel server using a firewall or network segmentation. Review and tighten access control policies within your internal network to minimize the potential impact of a successful SSRF attack. Monitor Zitadel logs for suspicious outbound requests that might indicate exploitation attempts. While a WAF might offer some protection, it's not a substitute for patching.