PT-2025-50278 · Zitadel · Zitadel

Amit-Laish · Published 2025-12-09 · Updated 2026-01-06 · CVE-2025-67495

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0-rc.1 through 4.7.0

Description ZITADEL, an open-source identity infrastructure tool, is susceptible to a DOM-Based Cross-Site Scripting (XSS) issue through the Zitadel V2 logout endpoint. The /logout API endpoint insecurely routes to a value supplied in the post logout redirect GET parameter. This allows an unauthenticated remote attacker to execute malicious JavaScript code in the browsers of ZITADEL users. The issue requires multiple active user sessions in the same browser to be exploited. Account takeover is mitigated when Multi-Factor Authentication (MFA) or Passwordless authentication is enabled.

Recommendations Versions prior to 4.7.1 should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67495

GHSA-V959-QXV6-6F8P

GO-2025-4213

SUSE-SU-2026:0037-1

Affected Products

Zitadel

References · 85

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67495.json · Exploit
• https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96 · Patch
• https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67495 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67495 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://suse.com/security/cve/CVE-2025-64702 · Note
• https://suse.com/security/cve/CVE-2025-64708 · Note