Critical severity · published Nov 20, 2025
CVE-2025-12414
Looker account compromise via punycode homograph attack
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 24.12.100+
* 24.18.193+
* 25.0.69+
* 25.6.57+
* 25.8.39+
* 25.10.22+
* 25.12.0+
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Looker · Google Cloud
before 24.12.100; before 24.18.193; before 25.0.69; before 25.6.57; before 25.8.39; before 25.10.22; +8 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12414
cloud.google.com
https://cloud.google.com/support/bulletins#GCP-2025-067
More from Looker
8.7
CVE-2026-15810
Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
7.7
CVE-2025-12741
Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
7.7
CVE-2025-12740
Remote Command Execution in Looker via IBM DB2 JDBC drive
7.5
CVE-2025-12742
Remote Code Execution in Looker via Teradata JDBC Driver
7.3
CVE-2025-12739
Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise