Read the docs
TI-2025-41254 Aliases CVE-2025-67495GHSA-v959-qxv6-6f8p

ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1github.com/zitadel/zitadel (Go): 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadelbefore 1.80.0-v2.20.0.20251208091519-4c879b47334e; 1.83.4 – 1.87.5; 4.0.0-rc.1 to before 4.7.11.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1Patch availableCNA
—github.com/zitadel/zitadel (Go)before 1.80.0-v2.20.0.20251208091519-4c879b47334e1.80.0-v2.20.0.20251208091519-4c879b47334ePatch availableGHSA-v959-qxv6-6f8p
—github.com/zitadel/zitadel (Go)1.83.4 – 1.87.5—No fix listedGHSA-v959-qxv6-6f8p
—github.com/zitadel/zitadel (Go)4.0.0-rc.1 to before 4.7.14.7.1Patch availableGHSA-v959-qxv6-6f8p
—github.com/zitadel/zitadel/v2 (Go)before 1.80.0-v2.20.0.20251208091519-4c879b47334e1.80.0-v2.20.0.20251208091519-4c879b47334ePatch availableGHSA-v959-qxv6-6f8p
  • zitadel Vendorzitadel Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e; 1.83.4 – 1.87.5; 4.0.0-rc.1 to before 4.7.1 Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1 Patch available CNA
  • github.com/zitadel/zitadel (Go) Vendor— Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Patch available GHSA-v959-qxv6-6f8p
  • github.com/zitadel/zitadel (Go) Vendor— Affected 1.83.4 – 1.87.5 Fixed in — No fix listed GHSA-v959-qxv6-6f8p
  • github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0-rc.1 to before 4.7.1 Fixed in 4.7.1 Patch available GHSA-v959-qxv6-6f8p
  • github.com/zitadel/zitadel/v2 (Go) Vendor— Affected before 1.80.0-v2.20.0.20251208091519-4c879b47334e Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Patch available GHSA-v959-qxv6-6f8p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*4.0.0 to before 4.7.1Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.7.1 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
  • Fix · GHSA-v959-qxv6-6f8p github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Advisory →
  • Fix · GHSA-v959-qxv6-6f8p github.com/zitadel/zitadel (Go) Fixed in 4.7.1 Advisory →
  • Fix · GHSA-v959-qxv6-6f8p github.com/zitadel/zitadel/v2 (Go) Fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67495
  2. 2026-10-03 Alias added: GHSA-v959-qxv6-6f8p

References

Patch 1

Advisory 2

Other 1

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences