CVE-2025-67494: zitadel from 4.0.0 (inclusive), before 4.7.1 (exclusive), >= 1.83.4, <= 1.87.5, >= 4.0.0-rc.1, < 4.7.1

Affected technology

zitadel · from 4.0.0 (inclusive), before 4.7.1 (exclusive)
zitadel

zitadel · < 1.80.0-v2.20.0.20251208091519-4c879b47334e, >= 1.83.4, <= 1.87.5, >= 4.0.0-rc.1, < 4.7.1
zitadel

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. Vendor/CNA’s CVSS 3.1 assessment (base score 9.3/10) rates confidentiality impact as high; integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 8.6/10) rates confidentiality impact as high; integrity and availability impact as none.