ZITADEL < 4.7.1 - Unauthenticated Server-Side Request Forgery via x-zitadel-forward-host Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-67494. PoCs published by Chocapikk.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-67494, an unauthenticated SSRF vulnerability in ZITADEL. The exploit automates the process of leaking Bearer tokens via SSRF and querying the ZITADEL Management API.
Description
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
Exploits (1)
This repository contains a functional exploit for CVE-2025-67494, an unauthenticated SSRF vulnerability in ZITADEL. The exploit automates the process of leaking Bearer tokens via SSRF and querying the ZITADEL Management API.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N