CVE-2026-105214

Name of the Vulnerable Software and Affected Versions Zitadel versions prior to 4.16.2

Description An issue exists where the server can be coerced into making requests to internal resources during organization domain HTTP verification. This occurs because the challenge fetch process utilizes the default http.Get function in Go instead of a protected client. Attackers can register domains that redirect to loopback, internal, or cloud metadata addresses, enabling them to scan ports and map internal networks. This is a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 4.16.2 or later.