Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M
CVE-2025-67495ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
High 8.0
In plain English
A high-severity cross-site scripting in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-v959-qxv6-6f8p |
| Go | github.com/zitadel/zitadel | no fix listed | GHSA-v959-qxv6-6f8p |
| Go | github.com/zitadel/zitadel | 4.7.1 | GHSA-v959-qxv6-6f8p |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GO-2025-4213 |
| Go | github.com/zitadel/zitadel/v2 | 1.80.0-v2.20.0.20251208091519-4c879b47334e | GHSA-v959-qxv6-6f8p |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N