Read the docs
TI-2025-40063 Aliases CVE-2025-64717GHSA-j4g7-v4m4-77px

ZITADEL vulnerable to Account Takeover with deactivated Instance IdP

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization's login policy before auto-linking an external user. No known workarounds are available aside from upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 4.6.6, 3.4.4, 2.71.19github.com/zitadel/zitadel (Go): 4.6.6, 3.4.4, 2.71.19 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadel4.0.0-rc.1 to before 4.6.6; 3.0.0-rc.1 to before 3.4.4; 2.50.0 to before 2.71.194.6.6, 3.4.4, 2.71.19Patch availableCNA
—github.com/zitadel/zitadel (Go)4.0.0-rc.1 to before 4.6.64.6.6Patch availableGHSA-j4g7-v4m4-77px
—github.com/zitadel/zitadel (Go)3.0.0-rc.1 to before 3.4.43.4.4Patch availableGHSA-j4g7-v4m4-77px
—github.com/zitadel/zitadel (Go)2.50.0 to before 2.71.192.71.19Patch availableGHSA-j4g7-v4m4-77px
—github.com/zitadel/zitadel (Go)1.80.0-v2.20.0.20240403060621-5b3946b67ef6 to before 1.80.0-v2.20.0.20251112124840-33c51deb20401.80.0-v2.20.0.20251112124840-33c51deb2040Patch availableGHSA-j4g7-v4m4-77px
  • zitadel Vendorzitadel Affected 4.0.0-rc.1 to before 4.6.6; 3.0.0-rc.1 to before 3.4.4; 2.50.0 to before 2.71.19 Fixed in 4.6.6, 3.4.4, 2.71.19 Patch available CNA
  • github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0-rc.1 to before 4.6.6 Fixed in 4.6.6 Patch available GHSA-j4g7-v4m4-77px
  • github.com/zitadel/zitadel (Go) Vendor— Affected 3.0.0-rc.1 to before 3.4.4 Fixed in 3.4.4 Patch available GHSA-j4g7-v4m4-77px
  • github.com/zitadel/zitadel (Go) Vendor— Affected 2.50.0 to before 2.71.19 Fixed in 2.71.19 Patch available GHSA-j4g7-v4m4-77px
  • github.com/zitadel/zitadel (Go) Vendor— Affected 1.80.0-v2.20.0.20240403060621-5b3946b67ef6 to before 1.80.0-v2.20.0.20251112124840-33c51deb2040 Fixed in 1.80.0-v2.20.0.20251112124840-33c51deb2040 Patch available GHSA-j4g7-v4m4-77px

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*2.50.0 to before 2.71.19; 3.0.0 to before 3.4.4; 4.0.0 to before 4.6.6Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 2.50.0 to before 2.71.19; 3.0.0 to before 3.4.4; 4.0.0 to before 4.6.6 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 4.6.6, 3.4.4, 2.71.19
  • Fix · GHSA-j4g7-v4m4-77px github.com/zitadel/zitadel (Go) Fixed in 4.6.6 Advisory →
  • Fix · GHSA-j4g7-v4m4-77px github.com/zitadel/zitadel (Go) Fixed in 3.4.4 Advisory →
  • Fix · GHSA-j4g7-v4m4-77px github.com/zitadel/zitadel (Go) Fixed in 2.71.19 Advisory →
  • Fix · GHSA-j4g7-v4m4-77px github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20251112124840-33c51deb2040 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64717
  2. 2026-10-03 Alias added: GHSA-j4g7-v4m4-77px

References

Patch 1

Advisory 1

Other 5

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences