Security Digest: December 8, 2025 - 4 Critical Vulnerabilities

Today, we alert you to four critical vulnerabilities affecting popular software systems, with potential for data exfiltration, account takeovers, and unauthorized access.

· 3 min read

Security Digest: December 8, 2025

Executive Summary

Today, we alert you to four critical vulnerabilities affecting popular software systems, with potential for data exfiltration, account takeovers, and unauthorized access. Immediate action is required to mitigate these risks.

Critical Vulnerabilities

  • CVE-2025-67494: Unauthenticated SSRF in Zitadel
    • Impact: Allows data exfiltration from internal services.
    • Affected Systems: Zitadel Login UI (v2) versions 4.0.0-rc.1 through 4.7.0.
    • Immediate Action: Upgrade to Zitadel version 4.7.1 immediately.
    • Mitigation: Configure a proxy to manage the x-zitadel-forward-host header.
  • CVE-2025-66627: Use-After-Free in Wasmi
    • Impact: Memory corruption, potential code execution.
    • Affected Systems: Wasmi versions 0.41.0 to 1.0.0.
    • Immediate Action: Upgrade Wasmi to the latest patched version.
    • Mitigation: Limit maximum linear memory sizes.
  • CVE-2025-67495: DOM-Based XSS in Zitadel Logout
    • Impact: Execution of malicious JS, potential account takeover.
    • Affected Systems: Zitadel Login UI (v2) versions 4.0.0-rc.1 through 4.7.0.
    • Immediate Action: Upgrade to Zitadel version 4.7.1 immediately.
    • Mitigation: Use logout_token for secure logout parameters.
  • CVE-2025-66507: CAPTCHA Bypass in 1Panel
    • Impact: Automated login attempts, increased ATO risk.
    • Affected Systems: 1Panel authentication API.
    • Immediate Action: Implement server-side validation for CAPTCHA verification.
    • Mitigation: Add MFA and IP reputation checks.

Previously Alerted

What to Do Now

  1. Immediately upgrade vulnerable systems to patched versions as listed.
  2. Verify all patches have been successfully applied.
  3. Monitor network traffic for any suspicious activity post-upgrade.
  4. Ensure additional security measures such as MFA are in place.

Related Resources

  • Official Zitadel Security Advisory
  • Wasmi GitHub Advisory
  • 1Panel Security Bulletin

Keep reading