{"id":"CVE-2025-67495","sourceIdentifier":"security-advisories@github.com","published":"2025-12-09T23:15:59.933","lastModified":"2026-10-14T21:10:00.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack, multiple user sessions need to be active in the same browser, however, account takeover is mitigated  when using Multi-Factor Authentication (MFA) or Passwordless authentication. This issue is fixed in version 4.7.1."},{"lang":"es","value":"ZITADEL es una herramienta de infraestructura de identidad de código abierto. Las versiones 4.0.0-rc.1 hasta la 4.7.0 son vulnerables a XSS basado en DOM a través del endpoint de cierre de sesión V2 de Zitadel. El endpoint /logout enruta de forma insegura a un valor que se suministra en el parámetro GET post_logout_redirect. Como resultado, un atacante remoto no autenticado puede ejecutar código JS malicioso en los navegadores de los usuarios de Zitadel. Para llevar a cabo un ataque, múltiples sesiones de usuario deben estar activas en el mismo navegador, sin embargo, la toma de control de la cuenta se mitiga al usar autenticación multifactor (MFA) o autenticación sin contraseña. Este problema se corrige en la versión 4.7.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zitadel","product":"zitadel","versions":[{"version":"< 1.80.0-v2.20.0.20251208091519-4c879b47334e","status":"affected"},{"version":">= 1.83.4, <= 1.87.5","status":"affected"},{"version":">= 4.0.0-rc.1, < 4.7.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-10T16:13:47.888251Z","id":"CVE-2025-67495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.7.1","matchCriteriaId":"E1B051D6-969F-4B70-BF3F-AFD77FB00251"}]}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}