by Kastro
Paper/Archive/CVE-2025-12414

CVE-2025-12414

Google Cloud Looker — Looker account compromise via punycode homograph attack

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
34
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 31.5.315 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.193+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+ * 25.12.0+

Affected

ProductAffectedFixed inSource
Looker< 24.12.10024.12.100CNA
Looker< 24.18.19324.18.193CNA
Looker< 25.0.6925.0.69CNA
Looker< 25.6.5725.6.57CNA
Looker< 25.8.3925.8.39CNA
Looker< 25.10.2225.10.22CNA
Looker< 25.12.025.12.0CNA
Looker< 24.12.10024.12.100CNA
Looker< 24.18.19324.18.193CNA
Looker< 25.0.6925.0.69CNA
Looker< 25.6.5725.6.57CNA
Looker< 25.8.3925.8.39CNA

Scores by source

GoogleCloud (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcloud.google.com/support/bulletins#GCP-2025-067