CVE-2025-67495: zitadel from 4.0.0 (inclusive), before 4.7.1 (exclusive), >= 1.83.4, <= 1.87.5, >= 4.0.0-rc.1, < 4.7.1

Affected technology

zitadel · from 4.0.0 (inclusive), before 4.7.1 (exclusive)
zitadel

zitadel · < 1.80.0-v2.20.0.20251208091519-4c879b47334e, >= 1.83.4, <= 1.87.5, >= 4.0.0-rc.1, < 4.7.1
zitadel

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

Unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. Vendor/CNA’s CVSS 3.1 assessment (base score 8.0/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality and integrity impact as low; availability impact as none.