CVE-2025-27501

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1.

• CWE-918
• CWE-918

• https://github.com/openziti/ziti-console/security/advisories/GHSA-fqxh-vfv5-8qjpThird Party Advisory

Published

Mar 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27496Snowflake, a platform for using artificial intelligence in t…3.3
• CVE-2025-27497OpenDJ is an LDAPv3 compliant directory service. OpenDJ prio…8.7
• CVE-2025-27498aes-gcm is a pure Rust implementation of the AES-GCM. In dec…5.6
• CVE-2025-27499WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-2750A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-27500OpenZiti is a free and open source project focused on bringi…6.1
• CVE-2025-27505GeoServer is an open source server that allows users to shar…5.3
• CVE-2025-27506NocoDB is software for building databases as spreadsheets. T…6.1
• CVE-2025-27507The open-source identity infrastructure software Zitadel all…9
• CVE-2025-27508Emissary is a P2P based data-driven workflow engine. The Che…7.5
• CVE-2025-27509fleetdm/fleet is an open source device management, built on …9.3
• CVE-2025-2751A vulnerability has been found in Open Asset Import Library …8.8