CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
Record from NVD · Published December 8, 2025
ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1.
EPSS 0.30% · 22.7th percentile
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| zitadel | zitadel | 4.0.0 |
Timeline
- Dec 10, 2025 EPSS Score (30 in total, the first dated here)
- Dec 10, 2025 PoC Published
- Dec 19, 2025 CVE Updated
- Mar 20, 2026 Security Advisory
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-67495
vulnetix vdb fixes CVE-2025-67495Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-67495/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart