CVE-2025-67494: 
NixOS vulnerability analysis and mitigation

CVE-2025-67494 is an unauthenticated full-read Server-Side Request Forgery (SSRF) vulnerability in ZITADEL's Login UI (V2), allowing remote attackers to force the server to make outbound HTTP requests to arbitrary domains — including internal addresses — and return the responses to the attacker. It affects ZITADEL versions 4.0.0-rc.1 through 4.7.0 (v4.x), as well as certain v1.x builds (>=1.83.4 through <=1.87.5). The vulnerability was discovered by Amit Laish of GE Vernova and disclosed on December 8, 2025. The GitHub Security Advisory assigns a CVSS v3.1 score of 9.3 (Critical), while NVD records a score of 8.6 (High) (Github Advisory, ZITADEL Advisory).

The root cause is improper validation of the x-zitadel-forward-host HTTP header (CWE-918: SSRF). The Login UI V2's service URL resolution logic unconditionally trusted this header as a fallback to determine which ZITADEL API instance to route requests to, without validating it against known instance domains or trusted domains. An unauthenticated attacker can craft an HTTP request with a manipulated x-zitadel-forward-host header pointing to an arbitrary internal or external host; the server then makes an outbound HTTP request to that target and returns the full response body to the attacker. No authentication, user interaction, or special privileges are required. The patch, committed at 4c879b47334e01d4fcab921ac1b44eda39acdb96, centralizes host resolution logic and validates all forwarded headers against instance and trusted domains before using them for API routing (ZITADEL Advisory, Patch Commit).

Successful exploitation enables an unauthenticated attacker to exfiltrate data from internal services reachable by the ZITADEL server, bypass IP-based access controls and network segmentation, and probe internal infrastructure. Because the server returns the full upstream response, this is a "full-read" SSRF — not merely a blind variant — meaning sensitive data such as cloud metadata, internal API responses, credentials, or configuration files can be directly read by the attacker. Integrity and availability are not directly impacted, but the high confidentiality impact and changed scope make this particularly dangerous in environments where ZITADEL has access to sensitive internal networks (Github Advisory, ZITADEL Advisory).

A public proof-of-concept exploit exists, referenced via Vulners and a GitHub repository attributed to user Chocapikk (github.com/Chocapikk/CVE-2025-67494) (Feedly). The vulnerability requires no authentication or user interaction, making it trivially exploitable against any exposed ZITADEL v4.x instance running the Login UI V2. The EPSS score is approximately 0.037% (11th percentile), suggesting limited automated exploitation activity at time of scoring (Github Advisory). There is no confirmed CISA KEV catalog listing or specific threat actor attribution as of the available data.

1. Reconnaissance: Identify internet-facing ZITADEL instances running Login UI V2 (versions 4.0.0-rc.1 through 4.7.0) using tools like Shodan or Censys, searching for ZITADEL login page fingerprints.
2. Craft malicious request: Prepare an HTTP request to any Login UI V2 endpoint (e.g., the login or accounts page) and inject a manipulated x-zitadel-forward-host header pointing to the desired internal target (e.g., x-zitadel-forward-host: 169.254.169.254 for cloud metadata, or an internal service hostname/IP).
3. Send the request: Submit the crafted request without any authentication credentials. The ZITADEL server's service URL resolution logic will use the attacker-controlled header value to construct the outbound API request URL.
4. Receive the response: The ZITADEL server makes an HTTP request to the attacker-specified internal host and returns the upstream response body to the attacker, enabling full data exfiltration from internal services.
5. Pivot and enumerate: Repeat with different internal addresses or ports to map internal services, extract credentials, cloud metadata tokens, or other sensitive data (ZITADEL Advisory, Github Advisory).

• Network: Unusual outbound HTTP requests from the ZITADEL server to internal IP ranges (RFC 1918), cloud metadata endpoints (e.g., 169.254.169.254), or unexpected external hosts; elevated request rates to Login UI V2 endpoints from a single source IP.
• Logs: ZITADEL access logs showing requests to Login UI V2 endpoints (e.g., /login, /accounts) containing the x-zitadel-forward-host header set to non-standard or internal hostnames; HTTP responses from the ZITADEL server containing content inconsistent with normal login UI responses.
• Application Logs: Server-side errors or unexpected HTTP client activity in ZITADEL application logs indicating outbound connections to internal addresses initiated by the login service.
• Proxy/Firewall: Outbound connections from the ZITADEL host to internal services or metadata endpoints that are not part of normal ZITADEL API communication patterns (ZITADEL Advisory).

Upgrade ZITADEL to version 4.7.1 or later (v4.x), or to 1.80.0-v2.20.0.20251208091519-4c879b47334e or later for v1.x builds. Before upgrading, ensure ZITADEL_API_URL is set and points to your instance, and that the HTTP host or x-forwarded-host header is correctly passed by your reverse proxy. As a workaround, configure a fronting reverse proxy to strip or overwrite all x-zitadel-forward-host header values before requests reach ZITADEL. Single-instance deployments that upgrade do not require additional configuration changes (ZITADEL Advisory, Github Advisory).

Security Online reported on the vulnerability alongside a related XSS issue, noting the combined risk of SSRF and account hijack potential in ZITADEL (SecurityOnline). Cyble tracked the vulnerability as part of their weekly critical IT vulnerability roundup (Cyble). The vulnerability was also highlighted in PoC-focused security digests for the weeks of December 15 and December 22, 2025, indicating community interest in the available exploit code. CISA included it in their vulnerability bulletin SB25-349.