External risk intelligence

Looker Account Takeover via OIDC Authentication String Normalization

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-12414

Looker is a business intelligence and analytics platform commonly deployed as a web-based service accessible to users over the network. Because it acts as a centralized dashboard and reporting gateway for enterprise data, these instances are frequently exposed to the internet or wide corporate network segments to facilitate remote user access.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability allows an attacker to potentially take over a Looker account if the instance uses OIDC authentication, due to how email addresses are handled. While Looker-hosted instances have been secured, self-hosted instances require immediate upgrades to the latest supported versions.

Attackers could gain unauthorized account access.
Centralized data access platform is at risk.
Confirm exposure and upgrade self-hosted instances.

Attack Path

How an attacker could exploit the issue

An attacker can compromise a Looker account by exploiting a weakness in how email addresses are handled when OIDC authentication is enabled. This flaw allows an attacker to gain unauthorized access to an account within the Looker instance. Once an account is taken over, the attacker could potentially access sensitive data or perform actions as that user, depending on the compromised account's privileges within Looker.

Network access required.
Email address normalization.
Account takeover and data access.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized access to a Looker account by exploiting a flaw in how email addresses are processed during OIDC authentication. This could affect Looker instances that use OIDC for user authentication, potentially exposing account access.

Looker accounts.
Exploiting email string normalization.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

For self-hosted Looker instances, ownership likely falls to the platform or infrastructure team responsible for managing the application and its underlying environment, with vendor-management teams potentially involved for coordinating with Looker. The immediate priority is to identify all self-hosted Looker deployments, confirm their exposure and criticality, and then plan for an upgrade to a patched version.

Platform/Infrastructure team owns remediation.
Verify all self-hosted Looker instances.
Upgrade to a patched version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Looker?

Looker is a business intelligence and data analytics platform used by organizations to visualize data, build reports, and create centralized dashboards. It functions as a web-based portal where users access enterprise insights. Because it aggregates valuable business data, Looker is typically deployed as a service reachable across corporate networks to support remote teams.

How does CVE-2025-12414 enable account takeover?

This vulnerability involves a weakness in authentication known as CWE-290, which relates to an authentication bypass by spoofing. In this specific case, the flaw exists in how Looker processes and normalizes email addresses when using OIDC (OpenID Connect) for login. By manipulating the email string during the authentication flow, an attacker can trick the system into granting them unauthorized access to another user's account.

Does my Looker instance trigger this vulnerability?

The vulnerability is triggered only if your Looker instance is configured to use OIDC authentication. Instances that do not utilize OIDC, or those that have already been updated to the corrected software versions, are not susceptible to this specific email normalization flaw. If your authentication method does not rely on OIDC, this attack path is not applicable.

How do I know if my instance is relevant?

According to Halo Surface Signal, Looker instances are frequently exposed to the internet or wide network segments to allow for remote analytics access. If your self-hosted instance is accessible over the internet or a broad network, it is a higher priority for assessment. You should determine if your specific deployment uses OIDC and verify its version against the patched release list.

What should I do if I run self-hosted Looker?

If you manage a self-hosted instance, your primary step is to identify all deployed versions and compare them against the list of patched releases provided by the vendor. Since this issue involves a critical authentication bypass, you must schedule and perform an upgrade to one of the specified secure versions immediately to close the vulnerability.

References

cloud.google.com/support/bulletins

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.