CVE-2025-67494
Server-side request forgery in Zitadel
CVSS score
8.6
EPSS probability
%0.4
Risk score
0.0
Published
10 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Similar Vulnerabilities
9.2
CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
Z
Patch status unknownEPSS %0
9.3
CVE-2026-109372
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Z
Patch status unknownEPSS %0
8.7
CVE-2026-85057
ZITADEL: Actions V1 sandbox escape: host file read via require()
Z
Patch verifiedEPSS %0
8.8
CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
Z
Patch status unknownEPSS %0
9.3
CVE-2026-105215
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
Z
Patch status unknownEPSS %0
9.2
CVE-2026-105211
ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
Z
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-67494"