Zitadel before version 4.16.2 contains a server‑side request forgery flaw that lets an attacker trigger HTTP requests to internal or cloud‑metadata addresses via organization domain HTTP verification. The vulnerability arises because the application uses Go's default http.Get instead of a protected HTTP client when fetching challenge data. An attacker can therefore register a domain that redirects to a loopback, internal, or cloud‑metadata address, causing the server to perform arbitrary requests. The impact is the ability to probe internal network services and map internal resources, which can enable further reconnaissance or attacks on the infrastructure.

Any installation of Zitadel with a version earlier than 4.16.2 is affected, regardless of other configuration details.

The CVSS score is 2.3, indicating low severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers likely need the ability to register organization domains, which means the exploitation surface may be limited to users with that privilege. The SSRF flaw allows remote actors to cause the server to reach internal endpoints, potentially leaking information about internal hosts, open ports, and services. Because the vulnerability is low severity, the exploitation probability is expected to be low, but successful exploitation could provide valuable reconnaissance data for future attacks.