CVE-2025-12414 | THREATINT

Description

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.193+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+ * 25.12.0+

PUBLISHED Reserved 2025-10-28 | Published 2025-11-20 | Updated 2025-11-20 | Assigner GoogleCloud

CRITICAL: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber

Problem types

CWE-290 Authentication Bypass by Spoofing

Product status

Default status

unaffected

Any version before 24.12.100

affected

Any version before 24.18.193

affected

Any version before 25.0.69

affected

Any version before 25.6.57

affected

Any version before 25.8.39

affected

Any version before 25.10.22

affected

Any version before 25.12.0

affected

Default status

unaffected

Any version before 24.12.100

affected

Any version before 24.18.193

affected

Any version before 25.0.69

affected

Any version before 25.6.57

affected

Any version before 25.8.39

affected

Any version before 25.10.22

affected

Any version before 25.12.0

affected

Credits

Sivanesh Ashok finder

Sreeram KL finder

References

cloud.google.com/support/bulletins

cve.org (CVE-2025-12414)

nvd.nist.gov (CVE-2025-12414)

Download JSON