CVE-2025-67494

ZITADEL Login UI (V2) unconditionally treats the HTTP header `x-zitadel-forward-host` as a trusted target source for all deployments, including self-hosted installations. An unauthenticated attacker can send a request with an arbitrarily set `x-zitadel-forward-host` header pointing to an internal network address or external domain. The ZITADEL server will execute the request to the specified address and return its contents to the attacker, enabling full-read SSRF.

An attacker can gain unauthorized access to internal network resources that are not publicly accessible, exfiltrate sensitive data, and bypass network segmentation mechanisms and access controls based on network topology.

Update ZITADEL to version 4.7.1, where the issue has been fixed. The patch is available in the project's GitHub repository (commit 4c879b47334e01d4fcab921ac1b44eda39acdb96). Until the update is applied, it is recommended to restrict access to the Login UI interface at the firewall or reverse proxy level and monitor unusual outgoing requests from the server.

ZITADEL in versions 4.7.0 and lower — affects all deployments, including self-hosted installations using ZITADEL Login UI V2.