Critical ZITADEL Flaws (CVE-2025-67494, CVSS 9.3) Risk SSRF Internal Breach and Account Hijack via XSS

SecurityOnline[.]info reports three high‑severity ZITADEL flaws in its V2 Login UI, led by CVE-2025-67494 with a CVSS of 9.3 that enables unauthenticated SSRF and potential internal breach via a manipulated URL resolution process. According to the advisory, the login interface “was vulnerable to service URL manipulation through the x-zitadel-forward-host header,” allowing an external attacker to force outbound requests, read responses, exfiltrate data and bypass certain network controls.

A second flaw, CVE-2025-67495, is a DOM‑based XSS in the post_logout_redirect parameter, while the third, an 8.1 host header injection, targets the password reset mechanism by crafting headers to point reset links at attacker‑controlled domains. All three issues have been addressed in ZITADEL version 4.7.1, with patches that validate X-Forwarded-Host and Forwarded headers and secure the logout flow using JWTs.

The article notes a workaround for lagging upgrades: configure a ZITADEL fronting proxy to delete forwarded header values or set them to the requested host before requests reach self‑hosted environments, as a defensive measure. December 10, 2025.