DOM-Based XSS Vulnerability in ZITADEL Identity Infrastructure Tool
CVE-2025-67495

8HIGH

Key Information:

Vendor

Zitadel

Status
Zitadel
Vendor
CVE Published:
9 December 2025

What is CVE-2025-67495?

The ZITADEL identity infrastructure tool versions 4.0.0-rc.1 through 4.7.0 contains a DOM-Based XSS vulnerability via an insecure logout endpoint. The /logout endpoint routes to a user-defined value from the post_logout_redirect GET parameter, allowing an unauthenticated attacker to execute malicious JavaScript code in the context of a user's browser where multiple sessions are active. Although account takeover risks exist, these can be mitigated by utilizing Multi-Factor Authentication (MFA) or Passwordless authentication. This security issue has been resolved in version 4.7.1.

Affected Version(s)

zitadel < 1.80.0-v2.20.0.20251208091519-4c879b47334e < 1.80.0-v2.20.0.20251208091519-4c879b47334e

zitadel >= 1.83.4, <= 1.87.5 <= 1.83.4, 1.87.5

zitadel >= 4.0.0-rc.1, < 4.7.1 < 4.0.0-rc.1, 4.7.1

References

https://github.com/zitadel/zitadel/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/4c879b47334e01d...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67495 : DOM-Based XSS Vulnerability in ZITADEL Identity Infrastructure Tool