CVE-2025-67495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67495
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67495.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-67495
Aliases
Downstream
Related
Published
2025-12-09T22:38:44.327Z
Modified
2026-04-09T04:07:02.284845Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
Details

ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the postlogoutredirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67495.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/zitadel/zitadel

Affected ranges

Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
2fcab95c5cf833f4b2a3460e8ea560146fbe8b6b
Last affected
d1b845a44cb4f23c5a8d82cf89bee4190c7c5809
Database specific 
{
    "versions": [
        {
            "introduced": "1.83.4"
        },
        {
            "last_affected": "1.87.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
8f0b7ebf028187e84881694bb931cbe33604e308
Fixed
38c7ce7e5250f433403abe9a9de9a8f47f5f39e3
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0-rc.1"
        },
        {
            "fixed": "4.7.1"
        }
    ]
}

Affected versions

v1.*
v1.83.4
v1.83.5
v1.83.6
v1.83.7
v1.84.0
v1.84.1
v1.84.2
v1.84.3
v1.84.4
v1.84.5
v1.85.0
v1.86.0
v1.87.0
v1.87.1
v1.87.2
v1.87.3
v1.87.4
v1.87.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67495.json"