Overview
A critical security vulnerability, identified as CVE-2025-12414, has been discovered in Looker. This vulnerability could allow an attacker to take over a Looker account in a Looker instance configured with OpenID Connect (OIDC) authentication. The issue stems from improper email address string normalization during the authentication process. While Looker-hosted instances have already been mitigated, self-hosted instances are vulnerable and require immediate patching.
Technical Details
CVE-2025-12414 arises from inconsistencies in how Looker handles email address normalization when using OIDC for authentication. An attacker could potentially exploit these inconsistencies to impersonate a legitimate user and gain unauthorized access to their Looker account. This attack is possible due to the way the system handles and compares email addresses received from the OIDC provider with existing user accounts.
CVSS Analysis
While the CVSS score is currently marked as N/A, the potential impact of this vulnerability is significant. Account takeover could lead to data breaches, unauthorized access to sensitive information, and disruption of business operations. Therefore, this vulnerability should be treated with the highest level of urgency.
Possible Impact
The exploitation of CVE-2025-12414 could have severe consequences for vulnerable Looker instances:
- Data Breach: An attacker could gain access to sensitive data stored within Looker.
- Unauthorized Access: Compromised accounts could be used to access other internal systems and resources.
- Business Disruption: The attacker could modify or delete data, disrupt reports, and hinder business intelligence operations.
- Reputational Damage: A successful attack could damage the organization’s reputation and erode customer trust.
Mitigation and Patch Steps
For Self-Hosted Looker Instances: The most crucial step is to upgrade your Looker instance to one of the patched versions listed below. This vulnerability has been patched in all supported versions of Self-hosted.
The following versions contain the fix for CVE-2025-12414:
- 24.12.100+
- 24.18.193+
- 25.0.69+
- 25.6.57+
- 25.8.39+
- 25.10.22+
- 25.12.0+
You can download the latest secure version of Looker from the official Looker download page: https://download.looker.com/
Important: After upgrading, thoroughly test your Looker instance to ensure the patch has been successfully applied and that all functionality is working as expected.
References
- Google Cloud Security Bulletin: https://cloud.google.com/support/bulletins#GCP-2025-067
- Looker Download Page: https://download.looker.com/
