{"id":"GO-2025-4124","revision":"1ca6c4d9d78c403e931130f10192ef06","records":[{"revision":"1ca6c4d9d78c403e931130f10192ef06","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4124","aliases":["CVE-2025-64717","GHSA-j4g7-v4m4-77px"],"title":"ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel","description":"ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel from v2.50.0 before v2.71.19, from v3.0.0-rc.1 before v3.4.4, from v4.0.0-rc.1 before v4.6.6.","state":0,"publishedAt":"2025-11-17T19:11:25+00:00","modifiedAt":"2025-11-17T19:58:43.820518+00:00","affected":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.80.0-v2.20.0.20240403060621-5b3946b67ef6"},{"kind":"fixed","version":"1.80.0-v2.20.0.20251112124840-33c51deb2040"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px","https://nvd.nist.gov/vuln/detail/CVE-2025-64717","https://github.com/zitadel/zitadel/commit/33c51deb20402dd5720e32cfb0c1d5fdc752f2e0","https://github.com/zitadel/zitadel/releases/tag/v2.71.19","https://github.com/zitadel/zitadel/releases/tag/v3.4.4","https://github.com/zitadel/zitadel/releases/tag/v4.6.6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4124","license":"OSV · upstream source license applies","key":"osv:GO-2025-4124","identifiers":["GO-2025-4124","CVE-2025-64717","GHSA-j4g7-v4m4-77px"]},"retained":false,"historicalAffected":[]}],"coverage":[]}