Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-49753

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.

Published

2024-10-25T14:15:12.280

Last Modified

2025-08-26T16:28:04.977

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-20
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zitadel zitadel < 2.58.7 Yes
Application zitadel zitadel < 2.59.5 Yes
Application zitadel zitadel < 2.60.4 Yes
Application zitadel zitadel < 2.61.4 Yes
Application zitadel zitadel < 2.62.8 Yes
Application zitadel zitadel < 2.63.6 Yes
Application zitadel zitadel < 2.64.1 Yes
References