Default Admin Password Vulnerability in NetBird VPN by NetBird
CVE-2025-10678

9.3CRITICAL

Key Information:

Vendor

Netbird Vpn

Status
Netbird
Vendor
CVE Published:
20 October 2025

What is CVE-2025-10678?

NetBird VPN has a security flaw where the default password for an admin account created by ZITADEL is not altered or removed when the software is installed using the vendor's provided script. This vulnerability primarily affects instances created with the vendor's installation script and may also extend to Docker instances if administrators fail to change the default password or remove the user. Users are encouraged to update to version 0.57.0 to mitigate this risk.

Affected Version(s)

NetBird 0 < 0.57.0

References

https://cert.pl/en/posts/2025/10/CVE-2025-10678
third-party-advisory
https://netbird.io/
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Sobieraj
JSON
.
CVE-2025-10678 : Default Admin Password Vulnerability in NetBird VPN by NetBird