Critical · published December 10, 2025
🚨 This is a serious one! An unauthenticated attacker can exploit ZITADEL’s SSRF vulnerability to read sensitive data from arbitrary domains, including internal network addresses. 🔥 Think of it like a sneaky delivery service that, instead of just delivering packages, starts reading the contents of every box along the way—without anyone checking their ID! That’s exactly what this SSRF allows an attacker to do by bypassing your network security. The consequences could be absolutely devastating! An attacker could access internal systems, extracting confidential information or even sensitive credentials, exposing your organization to further vulnerabilities and breaches. It’s like leaving the back door wide open for intruders to just stroll in and take whatever they want!
Think of it like a sneaky delivery service that, instead of just delivering packages, starts reading the contents of every box along the way—without anyone checking their ID! That’s exactly what this SSRF allows an attacker to do by bypassing your network security. This SSRF vulnerability in ZITADEL allows attackers to manipulate HTTP requests made by the server by exploiting the x-zitadel-forward-host header, which the system wrongly trusts. This misconfiguration means that an attacker can force the server to reach out to any domain, leading to unauthorized data access.
The consequences could be absolutely devastating! An attacker could access internal systems, extracting confidential information or even sensitive credentials, exposing your organization to further vulnerabilities and breaches. It’s like leaving the back door wide open for intruders to just stroll in and take whatever they want! Immediately upgrade ZITADEL to version 4.7.1 to patch this vulnerability. Additionally, review your configuration to ensure that headers are properly validated and implement network segmentation controls to minimize exposure. Don't overlook this one! You’ve got this! Follow these steps, and you’ll be on your way to securing your identity infrastructure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zitadel/zitadel | ≥ 4.0.0, < 4.7.1 | 4.7.1 |