9.2

CVE-2025-12414

Looker account compromise via punycode homograph attack

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable.

This issue has already been mitigated for Looker-hosted.


Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page   https://download.looker.com/ :
  *  24.12.100+
  *  24.18.193+
  *  25.0.69+
  *  25.6.57+
  *  25.8.39+
  *  25.10.22+
  *  25.12.0+
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGoogle Cloud
≫
Produkt Looker
Default Statusunaffected
Version 0
Version < 24.12.100
Status affected
Version 0
Version < 24.18.193
Status affected
Version 0
Version < 25.0.69
Status affected
Version 0
Version < 25.6.57
Status affected
Version 0
Version < 25.8.39
Status affected
Version 0
Version < 25.10.22
Status affected
Version 0
Version < 25.12.0
Status affected
HerstellerGoogle Cloud
≫
Produkt Looker
Default Statusunaffected
Version 0
Version < 24.12.100
Status affected
Version 0
Version < 24.18.193
Status affected
Version 0
Version < 25.0.69
Status affected
Version 0
Version < 25.6.57
Status affected
Version 0
Version < 25.8.39
Status affected
Version 0
Version < 25.10.22
Status affected
Version 0
Version < 25.12.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f45cbf4e-4146-4068-b7e1-655ffc2c548c 9.2 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.