PT-2025-46850 · Zitadel · Zitadel

CVE-2025-64717 · Published 2025-11-12 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.50.0 through 2.71.18 ZITADEL versions 3.0.0-rc.1 through 3.4.3 ZITADEL versions 4.0.0-rc.1 through 4.6.5

Description ZITADEL, an open source identity management platform, has a flaw in its federation process. This issue allows the auto-linking of users from external identity providers to existing ZITADEL users, even when the corresponding identity provider is inactive or federation is disallowed by the organization. The platform incorrectly validates login attempts and links external identities to internal accounts based on matching criteria. This can lead to Account Takeover, bypassing security controls. Accounts with Multi-Factor Authentication (MFA) enabled are not susceptible to this issue. The problem occurs only with identity providers created at the instance level, not those registered on other organizations.

Recommendations ZITADEL versions 2.50.0 through 2.71.18: Upgrade to version 2.71.19 or later. ZITADEL versions 3.0.0-rc.1 through 3.4.3: Update to version 3.4.4 or later. ZITADEL versions 4.0.0-rc.1 through 4.6.5: Upgrade to version 4.6.6 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-00127

CVE-2025-64717

GHSA-J4G7-V4M4-77PX

GO-2025-4124

OPENSUSE-SU-2026:21483-1

Affected Products

Zitadel

References · 1751

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64717.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00127 · Security Note
• https://osv.dev/vulnerability/GO-2025-4124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64717 · Security Note
• https://osv.dev/vulnerability/GHSA-j4g7-v4m4-77px · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64717 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.71.19 · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.6.6 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.4 · Note
• https://github.com/zitadel/zitadel/commit/33c51deb20402dd5720e32cfb0c1d5fdc752f2e0 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note