CVE-2025-27501

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Mar 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-275055.3GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API securiCVE-2025-275066.1NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to ReflecteCVE-2025-275079.0The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API coCVE-2025-275087.5Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it CVE-2025-275099.3fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-foCVE-2025-27518.8A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the functCVE-2025-275109.3conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-miCVE-2025-275117.2GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStoCVE-2025-275122.1Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actioCVE-2025-275137.5OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of CVE-2025-275145.4GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-275159.8Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted m