CVE-2026-55671
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in ZITADEL from version 4.0.0-rc.1 to 4.15.1 allows SSRF attacks due to inconsistent URL validation in HTTP notification channels, OIDC BackChannel logout, and SAML metadata URL fetches. Attackers can use DNS rebinding, redirects, or protocol downgrades to send requests to loopback, internal IP, or link-local endpoints.
Risk Assessment
The risk includes unauthorized access to internal network resources, potential data leaks, and the possibility of escalating attacks to other systems in the infrastructure.
Recommendation
Immediately update ZITADEL to version 4.15.2 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to loopback, internal IP, link-local, or redirected endpoints through DNS rebinding, redirects, or protocol downgrades. This issue is fixed in version 4.15.2.