CVE-2025-64717
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-12-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 2.50.0 (inc) to 2.71.19 (exc) |
| zitadel | zitadel | From 3.0.0 (inc) to 3.4.4 (exc) |
| zitadel | zitadel | From 4.0.0 (inc) to 4.6.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ZITADEL's federation process allows an attacker to auto-link their external identity from an identity provider (IdP) to an existing user account in ZITADEL, even if that IdP is disabled or federation is disallowed by the organization. This happens because the platform fails to enforce the organization's security settings during authentication. As a result, an attacker can bypass security controls and potentially take over an account, except for accounts protected by multi-factor authentication (MFA). The issue affects versions prior to 2.71.19, 3.4.4, and 4.6.6, which have fixed the problem by properly validating login policies before auto-linking.
How can this vulnerability impact me? :
This vulnerability can lead to a full account takeover by an attacker who exploits the auto-linking flaw to link their external identity to an existing internal user account. This bypasses the organization's security controls, potentially allowing unauthorized access to sensitive information or systems. However, accounts with multi-factor authentication enabled are not vulnerable to takeover through this attack.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade ZITADEL to version 4.6.6, 3.4.4, or 2.71.19 or later, as these versions resolve the issue by correctly validating the organization's login policy before auto-linking an external user. No known workarounds are available aside from upgrading.