CVE-2025-67495

ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96	Patch
https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ZITADEL es una herramienta de infraestructura de identidad de código abierto. Las versiones 4.0.0-rc.1 hasta la 4.7.0 son vulnerables a XSS basado en DOM a través del endpoint de cierre de sesión V2 de Zitadel. El endpoint /logout enruta de forma insegura a un valor que se suministra en el parámetro GET post_logout_redirect. Como resultado, un atacante remoto no autenticado puede ejecutar código JS malicioso en los navegadores de los usuarios de Zitadel. Para llevar a cabo un ataque, múltiples sesiones de usuario deben estar activas en el mismo navegador, sin embargo, la toma de control de la cuenta se mitiga al usar autenticación multifactor (MFA) o autenticación sin contraseña. Este problema se corrige en la versión 4.7.1.

Information

Published : 2025-12-09 23:15

Updated : 2026-10-14 21:10

NVD link : CVE-2025-67495

Mitre link : CVE-2025-67495

CVE.ORG link : CVE-2025-67495

JSON object : View

Products Affected

zitadel

zitadel

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-67495", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67495", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T16:13:47.888251Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": "< 1.80.0-v2.20.0.20251208091519-4c879b47334e"}, {"status": "affected", "version": ">= 1.83.4, <= 1.87.5"}, {"status": "affected", "version": ">= 4.0.0-rc.1, < 4.7.1"}]}]}], "published": "2025-12-09T23:15:59.933", "references": [{"url": "https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users\u2019 browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1."}, {"lang": "es", "value": "ZITADEL es una herramienta de infraestructura de identidad de c\u00f3digo abierto. Las versiones 4.0.0-rc.1 hasta la 4.7.0 son vulnerables a XSS basado en DOM a trav\u00e9s del endpoint de cierre de sesi\u00f3n V2 de Zitadel. El endpoint /logout enruta de forma insegura a un valor que se suministra en el par\u00e1metro GET post_logout_redirect. Como resultado, un atacante remoto no autenticado puede ejecutar c\u00f3digo JS malicioso en los navegadores de los usuarios de Zitadel. Para llevar a cabo un ataque, m\u00faltiples sesiones de usuario deben estar activas en el mismo navegador, sin embargo, la toma de control de la cuenta se mitiga al usar autenticaci\u00f3n multifactor (MFA) o autenticaci\u00f3n sin contrase\u00f1a. Este problema se corrige en la versi\u00f3n 4.7.1."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1B051D6-969F-4B70-BF3F-AFD77FB00251", "versionEndExcluding": "4.7.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}